Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Division by zero in WaveImage() of MagickCore/visual-effects.c #3296

Closed
pcy190 opened this issue Feb 25, 2021 · 2 comments
Closed

Division by zero in WaveImage() of MagickCore/visual-effects.c #3296

pcy190 opened this issue Feb 25, 2021 · 2 comments

Comments

@pcy190
Copy link

pcy190 commented Feb 25, 2021

Prerequisites

  • [√] I have written a descriptive issue title
  • [√] I have verified that I am using the latest version of ImageMagick
  • [√] I have searched open and closed issues to ensure it has not already been reported

Description

When the wave_length parameter was set to zero, a division by zero error would happen in line 3363.

((2.0*MagickPI*i)/wave_length));

Notice that wave_length is the parameter of the WaveImage function without any check:

MagickExport Image *WaveImage(const Image *image,const double amplitude,
const double wave_length,const PixelInterpolateMethod method,
ExceptionInfo *exception)

So a crafted parameter may trigger undefined behavior in the form of division by zero. Maybe there need a PerceptibleReciprocal() to do division in line 3363.

urban-warrior pushed a commit to ImageMagick/ImageMagick6 that referenced this issue Feb 26, 2021
@urban-warrior
Copy link
Member

Thanks for the problem report. We can reproduce it and will have a patch to fix it in the GIT main branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ https://imagemagick.org/download/beta/ by sometime tomorrow.

@pcy190
Copy link
Author

pcy190 commented Apr 26, 2021

CVE-2021-20309 has been assigned for it. We could find description on Red Hat Bugzilla.
However, the cve mitre database still shows that it is RESERVED.

@pcy190 pcy190 closed this as completed May 2, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants