memory leaks

[littleputa1]

ubuntu@ubuntu:~/fuzz_py$ magick -version
Version: ImageMagick 7.0.7-22 Q16 x86_64 2018-01-09 http://www.imagemagick.org
Copyright: © 1999-2018 ImageMagick Studio LLC
License: http://www.imagemagick.org/script/license.php
Features: Cipher DPC HDRI
Delegates (built-in): fontconfig freetype png x zlib

ubuntu@ubuntu:~/fuzz_py$ magick montage json.psd 1.json

=================================================================
==3057==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 26976 byte(s) in 2 object(s) allocated from:
#0 0x4b9ad3 in malloc (/usr/local/bin/magick+0x4b9ad3)
#1 0x7f6d649fb6fd in AcquireCriticalMemory /home/ubuntu/ImageMagick/./MagickCore/memory-private.h:57:10
#2 0x7f6d649ff83c in CloneImage /home/ubuntu/ImageMagick/MagickCore/image.c:826:25
#3 0x7f6d64e5d610 in ReadPSDLayersInternal /home/ubuntu/ImageMagick/coders/psd.c:1808:29
#4 0x7f6d64e60c6f in ReadPSDImage /home/ubuntu/ImageMagick/coders/psd.c:2196:11
#5 0x7f6d648acd91 in ReadImage /home/ubuntu/ImageMagick/MagickCore/constitute.c:497:13
#6 0x7f6d64da64b1 in EncodeImageAttributes /home/ubuntu/ImageMagick/coders/json.c:1512:14
#7 0x7f6d64da202d in WriteJSONImage /home/ubuntu/ImageMagick/coders/json.c:1716:12
#8 0x7f6d648b02d1 in WriteImage /home/ubuntu/ImageMagick/MagickCore/constitute.c:1114:14
#9 0x7f6d648b101b in WriteImages /home/ubuntu/ImageMagick/MagickCore/constitute.c:1333:13
#10 0x7f6d6420dc5c in MontageImageCommand /home/ubuntu/ImageMagick/MagickWand/montage.c:1797:15
#11 0x7f6d6418eefd in MagickCommandGenesis /home/ubuntu/ImageMagick/MagickWand/mogrify.c:183:14
#12 0x4e4ce7 in MagickMain /home/ubuntu/ImageMagick/utilities/magick.c:149:10
#13 0x4e4ce7 in main /home/ubuntu/ImageMagick/utilities/magick.c:180
#14 0x7f6d61fcef44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287

json.zip

[urban-warrior]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.

[littleputa1]

credit: nsfocus security team.

[littleputa1]

CVE-2018-5358