Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

memory leaks #928

Closed
littleputa opened this issue Jan 4, 2018 · 3 comments
Closed

memory leaks #928

littleputa opened this issue Jan 4, 2018 · 3 comments
Labels

Comments

@littleputa
Copy link

ubuntu@ubuntu:~/fuzz_py$ magick -version
Version: ImageMagick 7.0.7-17 Q16 x86_64 2017-12-26 http://www.imagemagick.org
Copyright: © 1999-2018 ImageMagick Studio LLC
License: http://www.imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP
Delegates (built-in): fontconfig freetype png x zlib

ubuntu@ubuntu:~/fuzz_py$ magick montage poc.rla /dev/null
montage: improper image header poc.rla' @ error/rla.c/ReadRLAImage/290. montage: /dev/null' @ error/montage.c/MontageImageCommand/1777.

=================================================================
==108460==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 8 byte(s) in 1 object(s) allocated from:
#0 0x4b9ad3 in malloc (/usr/local/bin/magick+0x4b9ad3)
#1 0x7f51b50cda5b in ReadRLAImage /home/ubuntu/ImageMagick/coders/rla.c:271:34
#2 0x7f51b4a5aaf1 in ReadImage /home/ubuntu/ImageMagick/MagickCore/constitute.c:497:13
#3 0x7f51b4a5d2f4 in ReadImages /home/ubuntu/ImageMagick/MagickCore/constitute.c:866:9
#4 0x7f51b436f3c7 in MontageImageCommand /home/ubuntu/ImageMagick/MagickWand/montage.c:410:20
#5 0x7f51b42f62d2 in MagickCommandGenesis /home/ubuntu/ImageMagick/MagickWand/mogrify.c:183:14
#6 0x4e4ce7 in MagickMain /home/ubuntu/ImageMagick/utilities/magick.c:149:10
#7 0x4e4ce7 in main /home/ubuntu/ImageMagick/utilities/magick.c:180
#8 0x7f51b1e76f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287

SUMMARY: AddressSanitizer: 8 byte(s) leaked in 1 allocation(s).

poc.zip

@urban-warrior
Copy link
Contributor

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.

@dlemstra dlemstra added the bug label Jan 4, 2018
@dlemstra dlemstra closed this as completed Jan 4, 2018
@littleputa
Copy link
Author

credit: nsfocus security team.

@littleputa
Copy link
Author

CVE-2018-5247

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

3 participants