Skip to content

memory leak in ReadOnePNGImage #600

Closed
@bestshow

Description

@bestshow

Version: ImageMagick 7.0.6-2 Q16 x86_64

The ReadOnePNGImage function in png.c:3439 allows attackers to cause a denial of service (memory leak) via a crafted file.

#./convert $FILE OUT.bmp
=================================================================
==104622==ERROR: detected memory leaks

Direct leak of 256 byte(s) in 1 object(s) allocated from:
    #0 0x4eb9c6 in __interceptor_malloc /home/test/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:66
    #1 0xc383f3 in ReadOnePNGImage /home/test/Downloads/IM-afl/ImageMagick-master/coders/png.c:3439:36
    #2 0xbf7b6e in ReadPNGImage /home/test/Downloads/IM-afl/ImageMagick-master/coders/png.c:4159:9
    #3 0xdeb41c in ReadImage /home/test/Downloads/IM-afl/ImageMagick-master/MagickCore/constitute.c:497:13
    #4 0xdef98d in ReadImages /home/test/Downloads/IM-afl/ImageMagick-master/MagickCore/constitute.c:866:9
    #5 0x1563cf7 in ConvertImageCommand /home/test/Downloads/IM-afl/ImageMagick-master/MagickWand/convert.c:641:18
    #6 0x173f78a in MagickCommandGenesis /home/test/Downloads/IM-afl/ImageMagick-master/MagickWand/mogrify.c:183:14
    #7 0x521f3d in MagickMain /home/test/Downloads/IM-afl/ImageMagick-master/utilities/magick.c:149:10
    #8 0x521f3d in main /home/test/Downloads/IM-afl/ImageMagick-master/utilities/magick.c:180
    #9 0x7fb133770b34 in __libc_start_main /usr/src/debug/glibc-2.17-c758a686/csu/../csu/libc-start.c:274

SUMMARY: 256 byte(s) leaked in 1 allocation(s).

testcase : https://github.com/bestshow/p0cs/blob/master/memory_leak_in_ReadOnePNGImage.png
Credit : ADLab of Venustech

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions