Null Pointer Dereference in sixel_decode

[jgj212]

ImageMagick 7.0.7-0 Q16 x86_64

Here is the critical code:

    *palette = (unsigned char *) AcquireQuantumMemory(*ncolors,4);   //line 535
    for (n = 0; n < (ssize_t) *ncolors; ++n) {
        (*palette)[n * 4 + 0] = sixel_palet[n] >> 16 & 0xff;
        (*palette)[n * 4 + 1] = sixel_palet[n] >> 8 & 0xff;
        (*palette)[n * 4 + 2] = sixel_palet[n] & 0xff;
        (*palette)[n * 4 + 3] = 0xff;
    }

AcquireQuantumMemory(...) may return NULL, so (*palette)[n * 4 + 0] will Dereference Null pointer to cause memory error.

Credit: ADLab of Venustech

[mikayla-grace]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ https://www.imagemagick.org/download/beta/ by sometime tomorrow.

[nohmask]

This was assigned CVE-2017-14626.