heap-buffer-overflow at MagickCore/log.c:1016:28 in TranslateEvent

[SuhwanSong]

Prerequisites

• I have written a descriptive issue title
• I have verified that I am using the latest version of ImageMagick
• I have searched open and closed issues to ensure it has not already been reported

Description

There's a heap-buffer-overflow at MagickCore/log.c:1016:28 in TranslateEvent.
I'm not sure it's ImageMagick bug, maybe from libpng.

Steps to Reproduce

run_cmd:
magick -seed 0 -debug Exception -log "�G�%b�<%%" -pointsize 68 "(" magick:rose -colorize 193,117,11 ")" tmp.png

Here's ASAN log.

==14457==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001b5d at pc 0x7f5bfee55055 bp 0x7ffc1f864430 sp 0x7ffc1f864428
READ of size 1 at 0x602000001b5d thread T0
    #0 0x7f5bfee55054 in TranslateEvent MagickCore/log.c:1016:28
    #1 0x7f5bfee53c77 in LogMagickEventList MagickCore/log.c:1320:8
    #2 0x7f5bfee51f3a in LogMagickEvent MagickCore/log.c:1422:10
    #3 0x7f5bfed976c1 in ThrowMagickExceptionList MagickCore/exception.c:1130:10
    #4 0x7f5bfed97196 in ThrowMagickException MagickCore/exception.c:1156:10
    #5 0x7f5bff518695 in MagickPNGWarningHandler coders/png.c:1748:10
    #6 0x7f5bf89dafd3 in png_user_version_check libpng-libpng16/png.c:232:7
    #7 0x7f5bf89db2c4 in png_create_png_struct libpng-libpng16/png.c:317:14
    #8 0x7f5bf8a6c69a in png_create_write_struct_2 libpng-libpng16/pngwrite.c:515:27
    #9 0x7f5bff52a858 in WriteOnePNGImage coders/png.c:9870:8
    #10 0x7f5bff4e65cb in WritePNGImage coders/png.c:12747:10
    #11 0x7f5bfec22575 in WriteImage MagickCore/constitute.c:1159:16
    #12 0x7f5bfec2349c in WriteImages MagickCore/constitute.c:1376:13
    #13 0x7f5bfe5e654d in CLINoImageOperator MagickWand/operation.c:4799:14
    #14 0x7f5bfe5ea20c in CLIOption MagickWand/operation.c:5261:7
    #15 0x7f5bfe42bf6d in ProcessCommandOptions MagickWand/magick-cli.c:529:3
    #16 0x7f5bfe42cd0a in MagickImageCommand MagickWand/magick-cli.c:796:5
    #17 0x7f5bfe476ba1 in MagickCommandGenesis MagickWand/mogrify.c:185:14
    #18 0x526f95 in MagickMain utilities/magick.c:149:10
    #19 0x5268e1 in main utilities/magick.c:180:10
    #20 0x7f5bf8eedb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #21 0x41b069 in _start (install/bin/magick+0x41b069)

0x602000001b5d is located 0 bytes to the right of 13-byte region [0x602000001b50,0x602000001b5d)
allocated by thread T0 here:
    #0 0x4e5397 in malloc (install/bin/magick+0x4e5397)
    #1 0x7f5bfee665a6 in AcquireMagickMemory MagickCore/memory.c:478:10
    #2 0x7f5bfee6660f in AcquireQuantumMemory MagickCore/memory.c:551:10
    #3 0x7f5bfeffa103 in ConstantString MagickCore/string.c:713:26
    #4 0x7f5bfee56aae in SetLogFormat MagickCore/log.c:1810:20
    #5 0x7f5bfe5be107 in CLISettingOptionInfo MagickWand/operation.c:1076:20
    #6 0x7f5bfe5ea1d9 in CLIOption MagickWand/operation.c:5253:7
    #7 0x7f5bfe42ba99 in ProcessCommandOptions MagickWand/magick-cli.c:477:7
    #8 0x7f5bfe42cd0a in MagickImageCommand MagickWand/magick-cli.c:796:5
    #9 0x7f5bfe476ba1 in MagickCommandGenesis MagickWand/mogrify.c:185:14
    #10 0x526f95 in MagickMain utilities/magick.c:149:10
    #11 0x5268e1 in main utilities/magick.c:180:10
    #12 0x7f5bf8eedb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow MagickCore/log.c:1016:28 in TranslateEvent

System Configuration

• ImageMagick version:
  Version: ImageMagick 7.0.8-51 Q16 x86_64 2019-07-01 https://imagemagick.org

• Environment (Operating system, version and so on):
  Description: Ubuntu 18.04.1 LTS
  Release: 18.04
  Codename: bionic

• Additional information:
  CC=clang-9 CXX=clang++-9 ./configure -disable-openmp

[urban-warrior]

Unfortunately, we cannot reproduce this problem. All other issues we could reproduce with afl-gcc under Fedora. This one does not trigger an overflow exception. We tried to install clang-9 per https://apt.llvm.org/ under Ubuntu 18.04.1 but was unsuccessful. We instead used clang-7 and again no overflow exception was triggered. Clang-9 is a development branch, perhaps a bug in clang?

[SuhwanSong]

I compiled with gcc-7 and with clang-3.8 on Ubuntu 16.04 and I found this is not reproduced.
But I found that "-log" option with "%" as argument triggers same exception.
Following cmd may trigger this overflow
magick -debug Resource -log "%" "(" magick:wizard "tmp"

Version: ImageMagick 7.0.8-52 Q16 x86_64 2019-07-01 https://imagemagick.org

Thank you,

[urban-warrior]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.