Description
INFO
Hello all.
We found a denial of service (DoS) issue in ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22 , which can cause huge CPU consumption. (CPU 100%)
magick -version
Version: ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22 http://www.imagemagick.org
Copyright: © 1999-2018 ImageMagick Studio LLC
License: http://www.imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP
Delegates (built-in): bzlib cairo djvu fftw fontconfig freetype gvc jbig jng jpeg lcms lqr lzma pangocairo png rsvg tiff webp wmf x xml zlib
The policy.xml is as following
<policymap>
<policy domain="resource" name="temporary-path" value="/tmp"/>
<policy domain="resource" name="memory" value="256MiB"/>
<policy domain="resource" name="map" value="512MiB"/>
<policy domain="resource" name="width" value="8KP"/>
<policy domain="resource" name="height" value="8KP"/>
<policy domain="resource" name="area" value="16KP"/>
<policy domain="resource" name="disk" value="1GiB"/>
<policy domain="resource" name="file" value="768"/>
<policy domain="resource" name="thread" value="2"/>
<policy domain="resource" name="throttle" value="0"/>
<policy domain="resource" name="time" value="120"/>
<policy domain="system" name="precision" value="6"/>
<policy domain="coder" rights="none" pattern="MVG" />
<policy domain="filter" rights="none" pattern="*" />
<policy domain="delegate" rights="none" pattern="HTTPS" />
<policy domain="path" rights="none" pattern="@*"/>
</policymap>
Trigger Command: magick convert ./cpu-exhaustion-GetImageIndexInList /dev/null
DEBUG
When debug we found a infinite loop in GetImageIndexInList at MagickCore/list.c:652
652 for (i=0; images->previous != (Image *) NULL; i++)
(gdb) n
653 images=images->previous;
(gdb)
652 for (i=0; images->previous != (Image *) NULL; i++)
(gdb)
653 images=images->previous;
(gdb)
652 for (i=0; images->previous != (Image *) NULL; i++)
(gdb)
653 images=images->previous;
(gdb)
652 for (i=0; images->previous != (Image *) NULL; i++)
(gdb)
653 images=images->previous;
(gdb) p images->previous
$1 = (struct _Image *) 0x62700145b900
(gdb) n
652 for (i=0; images->previous != (Image *) NULL; i++)
(gdb)
653 images=images->previous;
(gdb) p images->previous
$2 = (struct _Image *) 0x62700148c900
(gdb) n
652 for (i=0; images->previous != (Image *) NULL; i++)
(gdb)
653 images=images->previous;
(gdb) p images->previous
$3 = (struct _Image *) 0x627001485900
testcase: https://github.com/henices/pocs/raw/master/cpu-exhaustion-GetImageIndexInList
NSFocus Security Team <security (at) nsfocus (dot) com>