Null Pointer Dereference in PDFDelegateMessage

[jgj212]

ImageMagick 7.0.7-0 Q16 x86_64

Here is the critical code:

  if (*messages == (char *) NULL) 
    *messages=(char *) AcquireQuantumMemory(length+1,sizeof(char *));	//141
  else
    {
      offset=strlen(*messages);
      *messages=(char *) ResizeQuantumMemory(*messages,offset+length+1,
        sizeof(char *));
    }
  (void) memcpy(*messages+offset,message,length);
  (*messages)[length+offset] ='\0';
  return(length);

AcquireQuantumMemory(...) may return NULL, so (*messages)[length+offset] will Dereference Null pointer to cause memory error.

Credit: ADLab of Venustech

[mikayla-grace]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ https://www.imagemagick.org/download/beta/ by sometime tomorrow.

[nohmask]

This was assigned CVE-2017-15015.