memory leak in ReadMATImage

[bestshow]

Version: ImageMagick 7.0.6-2 Q16 x86_64

The ReadMATImage function in mat.c:570 allows attackers to cause a denial of service (memory leak) via a crafted file.

#./convert $FILE OUT.png
=================================================================
==9299==ERROR: detected memory leaks

Direct leak of 13488 byte(s) in 1 object(s) allocated from:
    #0 0x4eb9c6 in __interceptor_malloc /home/test/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:66
    #1 0x527b40 in AcquireImage /home/test/Downloads/IM-afl/ImageMagick-master/MagickCore/image.c:169:19
    #2 0x8d6338 in decompress_block /home/test/Downloads/IM-afl/ImageMagick-master/coders/mat.c:570:17
    #3 0x8d6338 in ReadMATImage /home/test/Downloads/IM-afl/ImageMagick-master/coders/mat.c:960
    #4 0xdeb41c in ReadImage /home/test/Downloads/IM-afl/ImageMagick-master/MagickCore/constitute.c:497:13
    #5 0xdef98d in ReadImages /home/test/Downloads/IM-afl/ImageMagick-master/MagickCore/constitute.c:866:9
    #6 0x1563cf7 in ConvertImageCommand /home/test/Downloads/IM-afl/ImageMagick-master/MagickWand/convert.c:641:18
    #7 0x173f78a in MagickCommandGenesis /home/test/Downloads/IM-afl/ImageMagick-master/MagickWand/mogrify.c:183:14
    #8 0x521f3d in MagickMain /home/test/Downloads/IM-afl/ImageMagick-master/utilities/magick.c:149:10
    #9 0x521f3d in main /home/test/Downloads/IM-afl/ImageMagick-master/utilities/magick.c:180
    #10 0x7f6a73146b34 in __libc_start_main /usr/src/debug/glibc-2.17-c758a686/csu/../csu/libc-start.c:274
......

SUMMARY: 50282 byte(s) leaked in 22 allocation(s).

testcase : https://github.com/bestshow/p0cs/blob/master/memory_leak_in_ReadMATImage.mat
Credit : ADLab of Venustech

[mikayla-grace]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.

[nohmask]

This was assigned CVE-2017-12564.