Skip to content

heap-buffer-overflow in MagickCore/fourier.c #1588

Closed
@SuhwanSong

Description

@SuhwanSong

Prerequisites

  • I have written a descriptive issue title
  • I have verified that I am using the latest version of ImageMagick
  • I have searched open and closed issues to ensure it has not already been reported

Description

There is a heap buffer overflow in MagickCore/fourier.c:314:19 in .omp_outlined.debug_

Heap buffer overflow sometimes occur. To trigger this bug, please run the command for several times.

Steps to Reproduce

run cmd:
magick "-seed" "0" "-black-point-compensation" "-fuzz" "238" "(" "magick:logo" "-normalize" "-cycle" "615" ")" "(" "magick:rose" "-gaussian-blur" "4" ")" "(" "magick:granite" "-convolve" "207,117,126,202,52,59,196,21,46,216,32,49,172,14,116,115,203,20,219,21,194,58,155,117,148,208,229,218,151,151,171,239,212,207,77,212,81,32,23,137,63,164,67,85,47,13,85,96,85,86,244,168,218,41,98,108,208,221,77,5,45,117,102,5,89,150,47,36,214,0,20,255,14,83,77,191,109,40,32,245,112" ")" "-strokewidth" "58" "-complex" "subtract" "-layers" "compare-overlay" ""

ASAN log about heap buffer over-flow.

==18953==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000020200 at pc 0x0000014f4b4e bp 0x7fa64464bc30 sp 0x7fa64464bc28
READ of size 4 at 0x619000020200 thread T2
    #0 0x14f4b4d in .omp_outlined._debug__ MagickCore/fourier.c:314:19
    #1 0x14f56cc in .omp_outlined. MagickCore/fourier.c:231:3
    #2 0x7fa64f983452 in __kmp_invoke_microtask (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x7c452)
    #3 0x7fa64f93d1b6  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x361b6)
    #4 0x7fa64f93bb20  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x34b20)
    #5 0x7fa64f97b417  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x74417)
    #6 0x7fa651fb76da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #7 0x7fa64f41f88e in clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)

0x619000020200 is located 0 bytes to the right of 896-byte region [0x61900001fe80,0x619000020200)
allocated by thread T2 here:
    #0 0x4f09b0 in __interceptor_posix_memalign (install/bin/magick+0x4f09b0)
    #1 0x5822fa in AcquireAlignedMemory MagickCore/memory.c:265:7
    #2 0xb24539 in AcquireCacheNexusPixels MagickCore/cache.c:4968:37
    #3 0xb0d587 in SetPixelCacheNexusPixels MagickCore/cache.c:5076:12
    #4 0xb04b7c in GetVirtualPixelCacheNexus MagickCore/cache.c:2751:10
    #5 0xb28621 in GetCacheViewVirtualPixels MagickCore/cache-view.c:664:10
    #6 0x14f2984 in .omp_outlined._debug__ MagickCore/fourier.c:249:8
    #7 0x14f56cc in .omp_outlined. MagickCore/fourier.c:231:3
    #8 0x7fa64f983452 in __kmp_invoke_microtask (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x7c452)
    #9 0x7fa64f93d1b6  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x361b6)

Thread T2 created by T0 here:
    #0 0x43fcd0 in pthread_create (install/bin/magick+0x43fcd0)
    #1 0x7fa64f979110  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x72110)

SUMMARY: AddressSanitizer: heap-buffer-overflow MagickCore/fourier.c:314:19 in .omp_outlined._debug__

System Configuration

  • ImageMagick version:
    Version: ImageMagick 7.0.8-50 Q16 x86_64 2019-06-10

  • Environment (Operating system, version and so on):
    Description: Ubuntu 18.04.1 LTS
    Release: 18.04
    Codename: bionic

  • Additional information: CC=clang-7 CXX=clang++-7

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions