Skip to content

Null Pointer Dereference in sixel_decode and sixel_output_create #721

Closed
@jgj212

Description

@jgj212

ImageMagick 7.0.7-0 Q16 x86_64

Here is the critical code:

	//sixel_decode
    *palette = (unsigned char *) AcquireQuantumMemory(*ncolors,4);   //line 535
    for (n = 0; n < (ssize_t) *ncolors; ++n) {
        (*palette)[n * 4 + 0] = sixel_palet[n] >> 16 & 0xff;
        (*palette)[n * 4 + 1] = sixel_palet[n] >> 8 & 0xff;
        (*palette)[n * 4 + 2] = sixel_palet[n] & 0xff;
        (*palette)[n * 4 + 3] = 0xff;
    }
	//sixel_output_create
	output = (sixel_output_t *) AcquireQuantumMemory(sizeof(sixel_output_t) + SIXEL_OUTPUT_PACKET_SIZE * 2, 1);		//line 549
    output->has_8bit_control = 0;
    output->save_pixel = 0;
    output->save_count = 0;
    output->active_palette = (-1);
    output->node_top = NULL;
    output->node_free = NULL;
    output->image = image;
    output->pos = 0;

AcquireQuantumMemory(...) may return NULL, so (*palette)[n * 4 + n] and output->xxx will Dereference Null pointer to cause memory error.

Credit: ADLab of Venustech

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions