Closed
Description
Version: ImageMagick 7.0.6-2 Q16 x86_64
The ReadOnePNGImage function in png.c:3439 allows attackers to cause a denial of service (memory leak) via a crafted file.
#./convert $FILE OUT.bmp
=================================================================
==104622==ERROR: detected memory leaks
Direct leak of 256 byte(s) in 1 object(s) allocated from:
#0 0x4eb9c6 in __interceptor_malloc /home/test/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:66
#1 0xc383f3 in ReadOnePNGImage /home/test/Downloads/IM-afl/ImageMagick-master/coders/png.c:3439:36
#2 0xbf7b6e in ReadPNGImage /home/test/Downloads/IM-afl/ImageMagick-master/coders/png.c:4159:9
#3 0xdeb41c in ReadImage /home/test/Downloads/IM-afl/ImageMagick-master/MagickCore/constitute.c:497:13
#4 0xdef98d in ReadImages /home/test/Downloads/IM-afl/ImageMagick-master/MagickCore/constitute.c:866:9
#5 0x1563cf7 in ConvertImageCommand /home/test/Downloads/IM-afl/ImageMagick-master/MagickWand/convert.c:641:18
#6 0x173f78a in MagickCommandGenesis /home/test/Downloads/IM-afl/ImageMagick-master/MagickWand/mogrify.c:183:14
#7 0x521f3d in MagickMain /home/test/Downloads/IM-afl/ImageMagick-master/utilities/magick.c:149:10
#8 0x521f3d in main /home/test/Downloads/IM-afl/ImageMagick-master/utilities/magick.c:180
#9 0x7fb133770b34 in __libc_start_main /usr/src/debug/glibc-2.17-c758a686/csu/../csu/libc-start.c:274
SUMMARY: 256 byte(s) leaked in 1 allocation(s).
testcase : https://github.com/bestshow/p0cs/blob/master/memory_leak_in_ReadOnePNGImage.png
Credit : ADLab of Venustech
Metadata
Metadata
Assignees
Labels
No labels