Memory Leak in AcquireImage()

[k0keoyo]

PoC URL: https://github.com/k0keoyo/im_poc/blob/master/Memory-Leak-13_output_picon_1501390784.98
Trigger Command: ./magick convert Memory-Leak-13_output_picon_1501390784.98 output.picon
Version:ImageMagick 7.0.6-4 Q16 x86_64 2017-07-29
Crash Detail:

==7270==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 13488 byte(s) in 1 object(s) allocated from:
#0 0x7f0029d5a9aa in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa)
#1 0x7f00292d5cb5 in AcquireImage MagickCore/image.c:169

[mikayla-grace]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.

[bastien-roucaries]

please open CVE

[bastien-roucaries]

CVE-2017-11751