memory leaks

[littleputa]

system：ubuntu 14.04 64

ubuntu@ubuntu:~/fuzz_py$ magick -version
Version: ImageMagick 7.0.7-12 Q16 x86_64 2017-12-19 http://www.imagemagick.org
Copyright: © 1999-2017 ImageMagick Studio LLC
License: http://www.imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP
Delegates (built-in): fontconfig freetype png x zlib

ubuntu@ubuntu:~/fuzz_py$ magick montage poc /dev/null
montage: no decode delegate for this image format ' @ error/constitute.c/ReadImage/509. montage: /dev/null' @ error/montage.c/MontageImageCommand/1775.

=================================================================
==116829==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 4712 byte(s) in 1 object(s) allocated from:
#0 0x4b9ad3 in malloc (/usr/local/bin/magick+0x4b9ad3)
#1 0x7ff9bd11fb76 in AcquireCriticalMemory /home/ubuntu/ImageMagick/./MagickCore/memory-private.h:57:10
#2 0x7ff9bd11fb76 in CloneMontageInfo /home/ubuntu/ImageMagick/MagickCore/montage.c:110
#3 0x7ff9bc8448b6 in MontageImageCommand /home/ubuntu/ImageMagick/MagickWand/montage.c:353:16
#4 0x7ff9bc7cd1c2 in MagickCommandGenesis /home/ubuntu/ImageMagick/MagickWand/mogrify.c:183:14
#5 0x4e4ce7 in MagickMain /home/ubuntu/ImageMagick/utilities/magick.c:149:10
#6 0x4e4ce7 in main /home/ubuntu/ImageMagick/utilities/magick.c:180
#7 0x7ff9ba34df44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287

Indirect leak of 4108 byte(s) in 1 object(s) allocated from:
#0 0x4b9ad3 in malloc (/usr/local/bin/magick+0x4b9ad3)
#1 0x7ff9bd318784 in AcquireString /home/ubuntu/ImageMagick/MagickCore/string.c:137:24
#2 0x7ff9bd120199 in GetMontageInfo /home/ubuntu/ImageMagick/MagickCore/montage.c:226:26
#3 0x7ff9bd11fb90 in CloneMontageInfo /home/ubuntu/ImageMagick/MagickCore/montage.c:111:3
#4 0x7ff9bc8448b6 in MontageImageCommand /home/ubuntu/ImageMagick/MagickWand/montage.c:353:16
#5 0x7ff9bc7cd1c2 in MagickCommandGenesis /home/ubuntu/ImageMagick/MagickWand/mogrify.c:183:14
#6 0x4e4ce7 in MagickMain /home/ubuntu/ImageMagick/utilities/magick.c:149:10
#7 0x4e4ce7 in main /home/ubuntu/ImageMagick/utilities/magick.c:180
#8 0x7ff9ba34df44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287

SUMMARY: AddressSanitizer: 8820 byte(s) leaked in 2 allocation(s).

poc.zip

[urban-warrior]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.

[littleputa]

credit: nsfocus security team.

[littleputa]

CVE-2017-18022