Exception / Process dies on Linux during JPG to PNG conversion

[PashaPash]

Magick.NET version

Magick.NET-Q8-AnyCPU, 14.12.0

Environment (Operating system, version and so on)

asp.net core 10.0, Ubuntu 24.04.3 LTS (WSL or docker)

Description

Changing the file format for the attached file from JPG to PNG fails on save for that specific file.

The process silently dies when executed in ASP.NET Core on Linux.

An exception is logged when running in a console app and in ASP.NET Core on Windows.

Unhandled exception. ImageMagick.MagickCoderErrorException: Incorrect data in iCCP `' @ error/png.c/MagickPNGError/1306
   at ImageMagick.MagickExceptionHelper.Check(IntPtr exception) in /_/src/Magick.NET/Exceptions/MagickExceptionHelper.cs:line 18
   at ImageMagick.NativeHelper.CheckException(IntPtr exception) in /_/src/Magick.NET/Native/NativeHelper.cs:line 20
   at ImageMagick.MagickImage.NativeMagickImage.WriteStream(IMagickSettings`1 settings, ReadWriteStreamDelegate writer, SeekStreamDelegate seeker, TellStreamDelegate teller, ReadWriteStreamDelegate reader, Void* data) in /_/src/Magick.NET/Generated/Magick.NET.SourceGenerator/ImageMagick.SourceGenerator.NativeInteropGenerator/MagickImage.g.cs:line 6635
   at ImageMagick.MagickImage.NativeMagickImage.WriteStream(IMagickSettings`1 settings, ReadWriteStreamDelegate writer, SeekStreamDelegate seeker, TellStreamDelegate teller, ReadWriteStreamDelegate reader) in /_/src/Magick.NET/MagickImage.cs:line 7893
   at ImageMagick.MagickImage.Write(Stream stream) in /_/src/Magick.NET/MagickImage.cs:line 7186
   at Program.<Main>$(String[] args) in /home/pavel/projects/magiccrash/Program.cs:line 17

This is a security issue for us, as an end user was able to bring down our application simply by re-uploading the file. This should not happen with default settings, even if the image is somehow invalid.

Steps to Reproduce

using (var image = new MagickImage(imagePath))
{
	image.Quality = 100;
	image.Format = MagickFormat.Png;

	MemoryStream stream = new MemoryStream();
	image.Write(stream);
}

Please see https://github.com/PashaPash/magiccrash/tree/aspnet for asp.net core example, https://github.com/PashaPash/magiccrash/tree/main for console app.

Images

20260408_1559101234.jpg

[dlemstra]

That specific image is invalid and an exception will be thrown when that image is read. You will need to add safeguards for this:

try
{
    using (var image = new MagickImage(imagePath))
    {
        image.Quality = 100;
        image.Format = MagickFormat.Png;

        MemoryStream stream = new MemoryStream();
        image.Write(stream);
    }
}
catch (MagickException exception)
{
    Console.WriteLine(exception.Message); // Or something else.
}

[PashaPash]

@dlemstra exception is thrown on Write, not on Read. The problem is that even with try-catch, it still kills the process on ASP.NET Core on Ubuntu!

See example repo for the full code snippet

// asp.net core controller
try
{
	using var imageStream = File.OpenRead(imagePath);
	var pngBytes = ConvertImageToPngBytes(imageStream);
	return Results.File(pngBytes, "image/png", "sample.png");
}
catch (Exception ex)
{
        // Instead of logging the error, the process just dies.
	return Results.Problem($"An error occurred: {ex.Message}");
}

static byte[] ConvertImageToPngBytes(Stream inputStream)
{
	using var image = new MagickImage(inputStream);
	image.Quality = 100;
	image.Format = MagickFormat.Png;

	using var outputStream = new MemoryStream();
	image.Write(outputStream);
	return outputStream.ToArray();
}

[PashaPash]

ASP.NET dies with segmentation fault 139, specifically.
It also only happens if there is a PNG format change.

[dlemstra]

I ran your console application on ubuntu 24 and it did not crash.

[PashaPash]

@dlemstra console app works. asp.net version crashes: https://github.com/PashaPash/magiccrash/tree/aspnet - it will crash the process on /sample request.

[PashaPash]

@dlemstra I traced it down to the stream-based constructor. The following snippets also segfault for me in a console app, although not on every run. I can capture a minidump if needed. I would appreciate any help troubleshooting this.

using ImageMagick;

const string imagePath = "sample.jpg";

try
{
	using var imageStream = File.OpenRead(imagePath);
	using (var image = new MagickImage(imageStream))
	{
		image.Quality = 100;
		image.Format = MagickFormat.Png;

		MemoryStream stream = new MemoryStream();
		image.Write(stream);
	}
}
catch (Exception ex)
{
	// not executed, segfault instead
	Console.WriteLine($"Caught: {ex.GetType().Name}: {ex.Message}");
}

is dies on dispose:

~/.dotnet/tools/dotnet-dump analyze /tmp/magiccrash-console-dumps/core_magiccrash_62762_1776458975 -c "threads" -c "clrstack -all" -c "exit"
Loading core dump: /tmp/magiccrash-console-dumps/core_magiccrash_62762_1776458975 ...
*0 0xF52A (62762)
 1 0xF52B (62763)
 2 0xF52C (62764)
 3 0xF52D (62765)
 4 0xF52E (62766)
 5 0xF52F (62767)
 6 0xF530 (62768)
OS Thread Id: 0xf52a
        Child SP               IP Call Site
00007FFC48129640 00007f5d53866813 [InlinedCallFrame: 00007ffc48129640] ImageMagick.MagickImage+NativeMethods+X64.MagickImage_Dispose(IntPtr)
00007FFC48129640 00007f5cd501580c [InlinedCallFrame: 00007ffc48129640] ImageMagick.MagickImage+NativeMethods+X64.MagickImage_Dispose(IntPtr)
00007FFC48129640 00007F5CD501580C ImageMagick.MagickImage+NativeMethods.MagickImage_Dispose(IntPtr) [/_/src/Magick.NET/Generated/Magick.NET.SourceGenerator/ImageMagick.SourceGenerator.NativeInteropGenerator/MagickImage.g.cs @ 1716]
00007FFC481296D0 00007F5CD501573C ImageMagick.MagickImage+NativeMagickImage.Dispose(IntPtr) [/_/src/Magick.NET/Generated/Magick.NET.SourceGenerator/ImageMagick.SourceGenerator.NativeInteropGenerator/MagickImage.g.cs @ 4497]
00007FFC481296F0 00007F5CD50030B7 ImageMagick.NativeInstance.set_Instance(IntPtr) [/_/src/Magick.NET/Native/NativeInstance.cs @ 28]
00007FFC48129710 00007F5CD50046FA ImageMagick.NativeInstance.Dispose() [/_/src/Magick.NET/Native/NativeInstance.cs @ 38]
00007FFC48129730 00007F5CD5011350 ImageMagick.MagickImage.DisposeInstance() [/_/src/Magick.NET/MagickImage.cs @ 7644]
00007FFC48129760 00007F5CD5018DB5 ImageMagick.MagickImage.Dispose(Boolean) [/_/src/Magick.NET/MagickImage.cs @ 7629]
00007FFC48129790 00007F5CD5018D5D ImageMagick.MagickImage.Dispose() [/_/src/Magick.NET/MagickImage.cs @ 2580]
00007FFC481297B0 00007F5CD50019D8 Program.<Main>$(System.String[]) [/home/pavel/projects/magiccrash/Program.cs @ 21]
00007FFC4812C5A0 00007f5d53589f6e [SoftwareExceptionFrame: 00007ffc4812c5a0]
00007FFC4812D3A0 00007F5CD50173B3 ImageMagick.MagickExceptionHelper.Check(IntPtr) [/_/src/Magick.NET/Exceptions/MagickExceptionHelper.cs @ 18]
00007FFC4812D3C0 00007F5CD5017332 ImageMagick.NativeHelper.CheckException(IntPtr) [/_/src/Magick.NET/Native/NativeHelper.cs @ 20]
00007FFC4812D3F0 00007F5CD5016880 ImageMagick.MagickImage+NativeMagickImage.WriteStream(ImageMagick.IMagickSettings`1<Byte>, ReadWriteStreamDelegate, SeekStreamDelegate, TellStreamDelegate, ReadWriteStreamDelegate, Void*) [/_/src/Magick.NET/Generated/Magick.NET.SourceGenerator/ImageMagick.SourceGenerator.NativeInteropGenerator/MagickImage.g.cs @ 6635]
00007FFC4812D460 00007F5CD50167B6 ImageMagick.MagickImage+NativeMagickImage.WriteStream(ImageMagick.IMagickSettings`1<Byte>, ReadWriteStreamDelegate, SeekStreamDelegate, TellStreamDelegate, ReadWriteStreamDelegate) [/_/src/Magick.NET/MagickImage.cs @ 7893]
00007FFC4812D4B0 00007F5CD501668F ImageMagick.MagickImage.Write(System.IO.Stream) [/_/src/Magick.NET/MagickImage.cs @ 7186]
00007FFC4812D520 00007F5CD50019A3 Program.<Main>$(System.String[]) [/home/pavel/projects/magiccrash/Program.cs @ 20]
OS Thread Id: 0xf52f
        Child SP               IP Call Site
00007F5D50E6ED60 00007f5d537eed71 [DebuggerU2MCatchHandlerFrame: 00007f5d50e6ed60]
OS Thread Id: 0xf530
        Child SP               IP Call Site
00007F5D4F381D60 00007f5d537eed71 [DebuggerU2MCatchHandlerFrame: 00007f5d4f381d60

[dlemstra]

I was able to get a bit more information with valgrind and due to a bug in ImageMagick the stream was left open in an incorrect state inside ImageMagick. I pushed a patch for it and this will be fixed in the next release.

[PashaPash]

Thanks for fixing this so quickly!

[dlemstra]

It even took a while longer than I wanted because I was testing with a debug build and this only happened with a release build. Thank you for your patience and updates.