Closed
Description
Version: ImageMagick 7.0.6-6 Q16 x86_64
A memory leak vulnerability was found in function WriteMETAImage in coders/meta.c,which allow attackers to cause a denial of service via a crafted file.
#./convert $FILE out.IPTCTEXT
=================================================================
==27191==ERROR: detected memory leaks
Direct leak of 35193 byte(s) in 1 object(s) allocated from:
#0 0x4ec5a6 in __interceptor_malloc /home/test/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:66
#1 0x8f4b97 in formatIPTC /home/test/Downloads/IM-afl/ImageMagick-master/coders/meta.c:1920:27
#2 0x8f4b97 in WriteMETAImage /home/test/Downloads/IM-afl/ImageMagick-master/coders/meta.c:2348
#3 0xe0232c in WriteImage /home/test/Downloads/IM-afl/ImageMagick-master/MagickCore/constitute.c:1114:14
#4 0xe035c7 in WriteImages /home/test/Downloads/IM-afl/ImageMagick-master/MagickCore/constitute.c:1333:13
#5 0x156881c in ConvertImageCommand /home/test/Downloads/IM-afl/ImageMagick-master/MagickWand/convert.c:3280:11
#6 0x174f66c in MagickCommandGenesis /home/test/Downloads/IM-afl/ImageMagick-master/MagickWand/mogrify.c:183:14
#7 0x5229f3 in MagickMain /home/test/Downloads/IM-afl/ImageMagick-master/utilities/magick.c:149:10
#8 0x5229f3 in main /home/test/Downloads/IM-afl/ImageMagick-master/utilities/magick.c:180
#9 0x7fe6c3302b34 in __libc_start_main /usr/src/debug/glibc-2.17-c758a686/csu/../csu/libc-start.c:274
35193 byte(s) leaked in 1 allocation(s).
testcase:https://github.com/bestshow/p0cs/blob/master/memory_leak_in_WriteMETAImage_formatIPTC
Credit:ADLab of Venustech