Skip to content

memory exhaustion in ReadICONImage #466

Closed
@jgj212

Description

@jgj212

ImageMagick 7.0.5-6

$magick identify $FILE

When identify icon file, imagemagick will allocate memory to store colormap in function ReadICONImage in coders\icon.c, line 449
//////////////////////////////////
if (AcquireImageColormap(image,image->colors,exception) ==
MagickFalse)
\\\\\\\\\\\\\\\\\\

image->colors can be controlled, as it is assigned as follow(line 431):
//////////////////////////////////
if ((icon_info.number_colors != 0) || (icon_info.bits_per_pixel <= 16U))
{
image->storage_class=PseudoClass;
image->colors=icon_info.number_colors; //can be controlled
if (image->colors == 0)
image->colors=one << icon_info.bits_per_pixel;
}
\\\\\\\\\\\\\\\\\\

icon_info.number_colors is diretly from icon file without checking( line 400)
//////////////////////////////////
icon_info.number_colors=ReadBlobLSBLong(image); //can be controlled by modify icon file
\\\\\\\\\\\\\\\\\\

So, modifying the number_colors can cause ImageMagick to allocate a anysize amount of memory, this may cause a memory exhaustion

Reproducer: https://github.com/jgj212/poc/blob/master/ImageMagick-7.0.5-6-colormap-memory-leak.ICON
Credit: ADLab of Venustech

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions