Join GitHub today
GitHub is home to over 31 million developers working together to host and review code, manage projects, and build software together.Sign up
memory exhaustion in ReadTGAImage #472
$magick identify $FILE
When identify VST file, imagemagick will allocate memory to store data in function ReadTGAImage in coders\tga.c (line 274)
tga_info.bits_per_pixel is diretly from VST file without checking in tga.c (line 231):
By review the founction code, tga_info.bits_per_pixel max valid value is 32.
Normally, this will not cause problem because image->storage_class is equal PseudoClass.
image_type is diretly from VST file
Memory allocation is earlly than the security checking
So, modifying the image_type and bits_per_pixel can cause ImageMagick to allocate a large amount of memory, this may cause a memory exhaustion
With the latest IM 7.0.5-6 compiled with afl-clang, we cannot reproduce the problem you posted. We get expected results:
Just tested this on a 64-bit build of Windows:
And with a debugger I get the following values:
image->colors=one << tga_info.bits_per_pixel; // 4294967296 if (image->colors > ((~0UL)/sizeof(*image->colormap))) // 4294967296 > 48806446 ThrowReaderException(CorruptImageError,"ImproperImageHeader");
this line is right
i am not sure whether next line will trigger before allocate memory with size_0x100000000
@dlemstra thank you. i will test it ago at tomorrow.