memory leak in ReadMPCImage coders/mpc.c:203

[jerryl3e]

version:
ImageMagick 7.0.7-1 Q16 x86_64
gcc 7.1

crash link :
https://raw.githubusercontent.com/jerryl3e/poc/master/im_poc_1504841049.icon

trigger command :
./magick convert im_poc_1504841049.icon output.mpc
./magick convert output.mpc output.art

detail :

root@work:/home/work/fuzzing/ImageMagick-7.0.7-1/utilities# ./magick convert im_poc_1504841049.icon output.mpc
root@work:/home/work/fuzzing/ImageMagick-7.0.7-1/utilities# ./magick convert output.mpc output.art

=================================================================
==34830==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x7faa9859f570 in posix_memalign (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdf570)
    #1 0x7faa97c2023d in AcquireAlignedMemory MagickCore/memory.c:262
    #2 0x7faa97a3edcc in AcquirePixelCacheNexus MagickCore/cache.c:264
    #3 0x7faa97a3ea74 in AcquirePixelCache MagickCore/cache.c:211
    #4 0x7faa97bdbc37 in AcquireImage MagickCore/image.c:206
    #5 0x7faa97e7c08f in ReadMPCImage coders/mpc.c:203
    #6 0x7faa97ab36b0 in ReadImage MagickCore/constitute.c:497
    #7 0x7faa97ab6597 in ReadImages MagickCore/constitute.c:866
    #8 0x7faa97389242 in ConvertImageCommand MagickWand/convert.c:641
    #9 0x7faa97482acd in MagickCommandGenesis MagickWand/mogrify.c:183
    #10 0x401a25 in MagickMain utilities/magick.c:149
    #11 0x401c9e in main utilities/magick.c:180
    #12 0x7faa96aae82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Indirect leak of 176 byte(s) in 1 object(s) allocated from:
    #0 0x7faa9859e920 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde920)
    #1 0x7faa97c20336 in AcquireMagickMemory MagickCore/memory.c:464
    #2 0x7faa97c2038a in AcquireQuantumMemory MagickCore/memory.c:537
    #3 0x7faa97a3eebd in AcquirePixelCacheNexus MagickCore/cache.c:268
    #4 0x7faa97a3ea74 in AcquirePixelCache MagickCore/cache.c:211
    #5 0x7faa97bdbc37 in AcquireImage MagickCore/image.c:206
    #6 0x7faa97e7c08f in ReadMPCImage coders/mpc.c:203
    #7 0x7faa97ab36b0 in ReadImage MagickCore/constitute.c:497
    #8 0x7faa97ab6597 in ReadImages MagickCore/constitute.c:866
    #9 0x7faa97389242 in ConvertImageCommand MagickWand/convert.c:641
    #10 0x7faa97482acd in MagickCommandGenesis MagickWand/mogrify.c:183
    #11 0x401a25 in MagickMain utilities/magick.c:149
    #12 0x401c9e in main utilities/magick.c:180
    #13 0x7faa96aae82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: 240 byte(s) leaked in 2 allocation(s).

Credit:Baidu Security Lab

[mikayla-grace]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.

[fgeek]

Please use CVE-2017-14325 for this issue.