Skip to content

Null Pointer Dereference in sixel_decode #720

Closed
@jgj212

Description

@jgj212

ImageMagick 7.0.7-0 Q16 x86_64

Here is the critical code:

    *palette = (unsigned char *) AcquireQuantumMemory(*ncolors,4);   //line 535
    for (n = 0; n < (ssize_t) *ncolors; ++n) {
        (*palette)[n * 4 + 0] = sixel_palet[n] >> 16 & 0xff;
        (*palette)[n * 4 + 1] = sixel_palet[n] >> 8 & 0xff;
        (*palette)[n * 4 + 2] = sixel_palet[n] & 0xff;
        (*palette)[n * 4 + 3] = 0xff;
    }

AcquireQuantumMemory(...) may return NULL, so (*palette)[n * 4 + 0] will Dereference Null pointer to cause memory error.

Credit: ADLab of Venustech

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions