When ImageMagick processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteUILImage() function in coders/uil.c. Upstream issue: https://github.com/ImageMagick/ImageMagick/issues/562