Use-of-uninitialized-value in function SyncImageSettings.

[YangY-Xiao]

Prerequisites

• [ Y ] I have written a descriptive issue title
• [ Y ] I have verified that I am using the latest version of ImageMagick
• [ Y ] I have searched open and closed issues to ensure it has not already been reported

Description

There is an issue in function SyncImageSettings in MagickCore/image.c. The issue is similar to https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6385 which was fixed in 56a19e7.

  if (image_info->density != (char *) NULL)
    {
      GeometryInfo
        geometry_info;

      flags=ParseGeometry(image_info->density,&geometry_info);
      image->resolution.x=geometry_info.rho;
      image->resolution.y=geometry_info.sigma;
      if ((flags & SigmaValue) == 0)
        image->resolution.y=image->resolution.x;
    }

Below is the proposal patch.

-          image->resolution.x=geometry_info.rho;
-          image->resolution.y=geometry_info.sigma;
-          if ((flags & SigmaValue) == 0)
-            image->resolution.y=image->resolution.x;
+          if ((flags & RhoValue) != 0)
+            image->resolution.x=geometry_info.rho;
+          image->resolution.y=image->resolution.x;
+          if ((flags & SigmaValue) != 0)
+            image->resolution.y=geometry_info.sigma;

[urban-warrior]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ https://www.imagemagick.org/download/beta/ by sometime tomorrow.

[nohmask]

This was assigned CVE-2019-12979.

[hlef]

Hi,

Please correct me if I'm wrong, but I think this patch has a few problems.

What if (flags & RhoValue) == 0? Then image->resolution.x remains uninitialized. Then we call image->resolution.y=image->resolution.x;, so image->resolution.y also contains garbage.

[urban-warrior]

image->resolution.x is initialized to zero before this code block so if the Rho value is not defined, image->resolution.y is set to zero.

[hlef]

Thanks for your answer. Indeed, image is memset-ed at https://github.com/ImageMagick/ImageMagick/blob/master/MagickCore/image.c#L173