out-of-bounds read in coders/psd.c:797 ReadPSDChannelPixels

[moshekaplan]

https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1533442

[moshekaplan]

Still present. See poc2 : https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1533442/+attachment/4550176/+files/id%3A000017%2Csig%3A06%2Csrc%3A000431%2Cop%3Aarith8%2Cpos%3A23%2Cval%3A-7

[dlemstra]

Can you give it another try? And thank you for sending us this fuzz reports 👍

[moshekaplan]

Still appears to be present: See poc3 https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1533442/comments/4

[moshekaplan]

poc4 may also be useful: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1533442/comments/5

[dlemstra]

Can you give it another try?

[moshekaplan]

The bug appears to have been resolved.

[attritionorg]

Can you link the fixing commit please?

[dlemstra]

If you want to create a patch for this you should use the commits from 15/16 jan to psd.c

[attritionorg]

I don't want to create a patch. The initial reporter said the bug "appears to have been resolved", in the span of a few days of back/forth comments on this ticket. 95% of vuln-related tickets in this project include the fixing commits. This is one of four or so that do not historically, which is not the normal. I assumed that was oversight, not a developer saying "well, this vuln isn't fixed, submit a patch!" =)

If this is patched, i'm simply asking for the commit to be linked against this ticket. If it is NOT fixed, i'd respectfully ask the developers to say so, after 'moshekaplan' said "The bug appears to have been resolved".

This is only about providing definitive information showing the bug is resolved, so that ImageMagick users can properly evaluate the risk, and factor in "there is a solution available".

[dlemstra]

I think you misunderstood my remark. I thought you wanted to create a patch yourself that you can use in an older version of ImageMagick. This issue has been fixed in the following patches:

280215b
198fffa