Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Dos: (failed to allocate) #999

Closed
netoico opened this issue Feb 23, 2018 · 2 comments
Closed

Dos: (failed to allocate) #999

netoico opened this issue Feb 23, 2018 · 2 comments
Labels
bug

Comments

@netoico
Copy link

netoico commented Feb 23, 2018 •
edited
Loading

Version: ImageMagick 7.0.7-23 Q16 x86_64 2018-02-22 http://www.imagemagick.org
Copyright: © 1999-2018 ImageMagick Studio LLC
License: http://www.imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP
Delegates (built-in): tiff

Trigger Command: convert ../test.tif /dev/null

ASAN OUTPUT

root@ubuntu:/opt/ImageMagick-7.0.7-23# convert ../test.tif /dev/null
==33250==ERROR: AddressSanitizer failed to allocate 0x7f10f2000 (34109071360) bytes of LargeMmapAllocator (errno: 12)
==33250==Process memory map follows:
0x000000400000-0x000000403000 /usr/local/bin/magick
0x000000602000-0x000000603000 /usr/local/bin/magick
0x000000603000-0x000000604000 /usr/local/bin/magick
0x00007fff7000-0x00008fff7000
0x00008fff7000-0x02008fff7000
0x02008fff7000-0x10007fff8000
0x600000000000-0x602000000000
0x602000000000-0x602000010000
0x602000010000-0x603000000000
0x603000000000-0x603000010000
0x603000010000-0x604000000000
0x604000000000-0x604000020000
0x604000020000-0x606000000000
0x606000000000-0x606000010000
0x606000010000-0x607000000000
0x607000000000-0x607000010000
0x607000010000-0x608000000000
0x608000000000-0x608000010000
0x608000010000-0x60a000000000
0x60a000000000-0x60a000010000
0x60a000010000-0x60b000000000
0x60b000000000-0x60b000010000
0x60b000010000-0x60c000000000
0x60c000000000-0x60c000010000
0x60c000010000-0x60e000000000
0x60e000000000-0x60e000010000
0x60e000010000-0x60f000000000
0x60f000000000-0x60f000010000
0x60f000010000-0x610000000000
0x610000000000-0x610000010000
0x610000010000-0x611000000000
0x611000000000-0x611000010000
0x611000010000-0x612000000000
0x612000000000-0x612000010000
0x612000010000-0x614000000000
0x614000000000-0x614000020000
0x614000020000-0x615000000000
0x615000000000-0x615000020000
0x615000020000-0x616000000000
0x616000000000-0x616000020000
0x616000020000-0x618000000000
0x618000000000-0x618000020000
0x618000020000-0x619000000000
0x619000000000-0x619000020000
0x619000020000-0x61a000000000
0x61a000000000-0x61a000020000
0x61a000020000-0x61d000000000
0x61d000000000-0x61d000020000
0x61d000020000-0x621000000000
0x621000000000-0x621000020000
0x621000020000-0x622000000000
0x622000000000-0x622000020000
0x622000020000-0x623000000000
0x623000000000-0x623000020000
0x623000020000-0x624000000000
0x624000000000-0x624000020000
0x624000020000-0x625000000000
0x625000000000-0x625000020000
0x625000020000-0x627000000000
0x627000000000-0x627000030000
0x627000030000-0x62d000000000
0x62d000000000-0x62d000020000
0x62d000020000-0x62f000000000
0x62f000000000-0x62f000030000
0x62f000030000-0x640000000000
0x640000000000-0x640000003000
0x7f5db31cb000-0x7f5db4b41000
0x7f5db4b41000-0x7f5db5500000 /usr/lib/locale/locale-archive
0x7f5db5500000-0x7f5db5600000
0x7f5db5700000-0x7f5db5800000
0x7f5db5882000-0x7f5db7bd4000
0x7f5db7bd4000-0x7f5db7bf5000 /usr/lib/x86_64-linux-gnu/libgomp.so.1.0.0
0x7f5db7bf5000-0x7f5db7df4000 /usr/lib/x86_64-linux-gnu/libgomp.so.1.0.0
0x7f5db7df4000-0x7f5db7df5000 /usr/lib/x86_64-linux-gnu/libgomp.so.1.0.0
0x7f5db7df5000-0x7f5db7df6000 /usr/lib/x86_64-linux-gnu/libgomp.so.1.0.0
0x7f5db7df6000-0x7f5db7e56000 /usr/local/lib/libtiff.so.5.2.6
0x7f5db7e56000-0x7f5db8056000 /usr/local/lib/libtiff.so.5.2.6
0x7f5db8056000-0x7f5db8059000 /usr/local/lib/libtiff.so.5.2.6
0x7f5db8059000-0x7f5db805a000 /usr/local/lib/libtiff.so.5.2.6
0x7f5db805a000-0x7f5db8070000 /lib/x86_64-linux-gnu/libgcc_s.so.1
0x7f5db8070000-0x7f5db826f000 /lib/x86_64-linux-gnu/libgcc_s.so.1
0x7f5db826f000-0x7f5db8270000 /lib/x86_64-linux-gnu/libgcc_s.so.1
0x7f5db8270000-0x7f5db8378000 /lib/x86_64-linux-gnu/libm-2.23.so
0x7f5db8378000-0x7f5db8577000 /lib/x86_64-linux-gnu/libm-2.23.so
0x7f5db8577000-0x7f5db8578000 /lib/x86_64-linux-gnu/libm-2.23.so
0x7f5db8578000-0x7f5db8579000 /lib/x86_64-linux-gnu/libm-2.23.so
0x7f5db8579000-0x7f5db857c000 /lib/x86_64-linux-gnu/libdl-2.23.so
0x7f5db857c000-0x7f5db877b000 /lib/x86_64-linux-gnu/libdl-2.23.so
0x7f5db877b000-0x7f5db877c000 /lib/x86_64-linux-gnu/libdl-2.23.so
0x7f5db877c000-0x7f5db877d000 /lib/x86_64-linux-gnu/libdl-2.23.so
0x7f5db877d000-0x7f5db893d000 /lib/x86_64-linux-gnu/libc-2.23.so
0x7f5db893d000-0x7f5db8b3c000 /lib/x86_64-linux-gnu/libc-2.23.so
0x7f5db8b3c000-0x7f5db8b40000 /lib/x86_64-linux-gnu/libc-2.23.so
0x7f5db8b40000-0x7f5db8b42000 /lib/x86_64-linux-gnu/libc-2.23.so
0x7f5db8b42000-0x7f5db8b46000
0x7f5db8b46000-0x7f5db8b5e000 /lib/x86_64-linux-gnu/libpthread-2.23.so
0x7f5db8b5e000-0x7f5db8d5d000 /lib/x86_64-linux-gnu/libpthread-2.23.so
0x7f5db8d5d000-0x7f5db8d5e000 /lib/x86_64-linux-gnu/libpthread-2.23.so
0x7f5db8d5e000-0x7f5db8d5f000 /lib/x86_64-linux-gnu/libpthread-2.23.so
0x7f5db8d5f000-0x7f5db8d63000
0x7f5db8d63000-0x7f5db9138000 /usr/local/lib/libMagickWand-7.Q16HDRI.so.5.0.0
0x7f5db9138000-0x7f5db9337000 /usr/local/lib/libMagickWand-7.Q16HDRI.so.5.0.0
0x7f5db9337000-0x7f5db9338000 /usr/local/lib/libMagickWand-7.Q16HDRI.so.5.0.0
0x7f5db9338000-0x7f5db9384000 /usr/local/lib/libMagickWand-7.Q16HDRI.so.5.0.0
0x7f5db9384000-0x7f5db9be3000 /usr/local/lib/libMagickCore-7.Q16HDRI.so.5.0.0
0x7f5db9be3000-0x7f5db9de2000 /usr/local/lib/libMagickCore-7.Q16HDRI.so.5.0.0
0x7f5db9de2000-0x7f5db9e85000 /usr/local/lib/libMagickCore-7.Q16HDRI.so.5.0.0
0x7f5db9e85000-0x7f5db9f6f000 /usr/local/lib/libMagickCore-7.Q16HDRI.so.5.0.0
0x7f5db9f6f000-0x7f5db9f72000
0x7f5db9f72000-0x7f5dba066000 /usr/lib/x86_64-linux-gnu/libasan.so.2.0.0
0x7f5dba066000-0x7f5dba266000 /usr/lib/x86_64-linux-gnu/libasan.so.2.0.0
0x7f5dba266000-0x7f5dba269000 /usr/lib/x86_64-linux-gnu/libasan.so.2.0.0
0x7f5dba269000-0x7f5dba26a000 /usr/lib/x86_64-linux-gnu/libasan.so.2.0.0
0x7f5dba26a000-0x7f5dbaedf000
0x7f5dbaedf000-0x7f5dbaf05000 /lib/x86_64-linux-gnu/ld-2.23.so
0x7f5dbb053000-0x7f5dbb0ed000
0x7f5dbb0ed000-0x7f5dbb104000
0x7f5dbb104000-0x7f5dbb105000 /lib/x86_64-linux-gnu/ld-2.23.so
0x7f5dbb105000-0x7f5dbb106000 /lib/x86_64-linux-gnu/ld-2.23.so
0x7f5dbb106000-0x7f5dbb107000
0x7fff823d9000-0x7fff823fa000 [stack]
0x7fff823fc000-0x7fff823fe000 [vvar]
0x7fff823fe000-0x7fff82400000 [vdso]
0xffffffffff600000-0xffffffffff601000 [vsyscall]
==33250==End of process memory map.
==33250==AddressSanitizer CHECK failed: ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix.cc:121 "(("unable to mmap" && 0)) != (0)" (0x0, 0x0)
#0 0x7f5dba012631 (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa0631)
#1 0x7f5dba017613 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa5613)
#2 0x7f5dba01f641 (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xad641)
#3 0x7f5db9f94c0c (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x22c0c)
#4 0x7f5dba00a5d2 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x985d2)
#5 0x7f5db970b3a1 in AcquireMagickMemory MagickCore/memory.c:468
#6 0x7f5db9a425b9 in ReadTIFFImage coders/tiff.c:1760
#7 0x7f5db95aac05 in ReadImage MagickCore/constitute.c:497
#8 0x7f5db95ace45 in ReadImages MagickCore/constitute.c:867
#9 0x7f5db8e5b0f7 in ConvertImageCommand MagickWand/convert.c:641
#10 0x7f5db8f714ad in MagickCommandGenesis MagickWand/mogrify.c:183
#11 0x401781 in MagickMain utilities/magick.c:149
#12 0x401962 in main utilities/magick.c:180
#13 0x7f5db879d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#14 0x401298 in _start (/usr/local/bin/magick+0x401298)

root@ubuntu:/opt/ImageMagick-7.0.7-23#

System Configuration
ImageMagick version: ImageMagick 7.0.7-22 Q16 x86_64
Environment (Operating system, version and so on):
Description: Ubuntu 16.04.1 LTS x86_64

test.zip

credit: zxsoft security team.
@urban-warrior
Copy link
Member

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.

urban-warrior pushed a commit that referenced this issue Feb 23, 2018
https://github.com/ImageMagick/ImageMagick/issues/999
5c0e1a3
urban-warrior pushed a commit that referenced this issue Feb 23, 2018
https://github.com/ImageMagick/ImageMagick/issues/999
1f7c6b1
@netoico
Copy link
Author

netoico commented Feb 24, 2018

CVE-2018-7443

@dlemstra dlemstra added the bug label Feb 24, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Milestone
No milestone
Development

No branches or pull requests
3 participants
@dlemstra @urban-warrior @netoico