Closed
Description
ImageMagick 7.0.7-0 Q16 x86_64
Here is the critical code:
//sixel_decode
*palette = (unsigned char *) AcquireQuantumMemory(*ncolors,4); //line 535
for (n = 0; n < (ssize_t) *ncolors; ++n) {
(*palette)[n * 4 + 0] = sixel_palet[n] >> 16 & 0xff;
(*palette)[n * 4 + 1] = sixel_palet[n] >> 8 & 0xff;
(*palette)[n * 4 + 2] = sixel_palet[n] & 0xff;
(*palette)[n * 4 + 3] = 0xff;
}
//sixel_output_create
output = (sixel_output_t *) AcquireQuantumMemory(sizeof(sixel_output_t) + SIXEL_OUTPUT_PACKET_SIZE * 2, 1); //line 549
output->has_8bit_control = 0;
output->save_pixel = 0;
output->save_count = 0;
output->active_palette = (-1);
output->node_top = NULL;
output->node_free = NULL;
output->image = image;
output->pos = 0;
AcquireQuantumMemory(...) may return NULL, so (*palette)[n * 4 + n] and output->xxx will Dereference Null pointer to cause memory error.
Credit: ADLab of Venustech