PerlMagick - Segfault when reading invalid PNG image

[newsanon]

Here is the code:

Code: Select all

$image = new Image::Magick;
$image->ReadImage($filename)

Here is the image (uuencoded):

Code: Select all

begin 644 test.png
MB5!.1PT*&@H````-24A$4@```?0```"Y"`````#[#))0`````7-21T(`KLX<
MZ0````1G04U!``"QCPO\804````)<$A9<P``#L,```[#`<=OJ&0``%.O241!
M5'C:[%UG8!35VG[.S&S?[&YZ[STD)(30(?1F0Q05&U94Q/I=RU6OO8+7=A44
M%+`@7)KT%IKT#H$4TGM/-FVS?6?.]V/322!B(G#E_$EVYDP[SWG?\_9#9&'X
M>[8JN/U-OSR+BSCS-_WT+_'"W_3+$SCA;_KEL/Y=/QP"][?]=/JW_7(PN-%N
M@-Y&"55-G0_IJBZS&-#:VAM#>OV`WIB1>3ZEPYFR]_[=J:]YW7.5E[Z;8<D+
M_(TQO6Y`+WSXW6\_6F(!8&J6<[P?K>K45SS34[CDBD@5S_,6`'S'/N8^_H:<
MQ;FMVLCW#9?O?^HGR]\;]!9!+F9:X@C;"SZ3-^[QK'DP#KI/>>(C[]272,4?
M1!0]$PBL/"NE+SA_5O5@=.X7WL^W]%M00&/E#/;N5#0\'@G+XAI;Y/W`EM\U
MUML&]LK+5BZUTB;'YQ6=#MN.B(*;_Y6N2QAPV=M(5DSVN$'I`&`S@WON".T_
4M^+Q996Q0G8`````245.1*Y"8((`
`
end

[magick]

We're using ImageMagick 6.8.7-5. We get:

• > convert test.png null:
  convert: Expected 8192 bytes; found 379 bytes `test.png' @ warning/png.c/MagickPNGWarningHandler/1830.
  convert: Read Exception `test.png' @ error/png.c/MagickPNGErrorHandler/1804.
  convert: corrupt image `test.png' @ error/png.c/ReadPNGImage/4051.
  convert: no images defined `null:' @ error/convert.c/ConvertImageCommand/3145.

[newsanon]

Yes, "convert test.png null:" works fine for me (ImageMagick 6.8.0-7). Did you try to actually read this file using Perl library?

Code: Select all

$filename = "test.png";
$image = new Image::Magick;
$image->ReadImage($filename);

I'm getting segfault on string "$image->ReadImage($filename);"

[newsanon]

magick,

I finally realized I have problems with all PNG images, not just the invalid ones. All functions accessing PNG image resulting in segfault. I'm running ImageMagick 6.8.7-4 2013-11-06 Q16 on Mac OS X Snow Leopard x64.

Here's what I'm getting in GDB:

Code: Select all

gdb --args /opt/local/bin/perl -w test.pl

...

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x00007fff89d7cc00 in strlen ()
(gdb) bt
#0  0x00007fff89d7cc00 in strlen ()
#1  0x00007fff89d885fc in __vfprintf ()
#2  0x00007fff89e40ed8 in vsnprintf_l ()
#3  0x00000001010eb9b2 in FormatLocaleStringList ()
#4  0x00000001010eba94 in FormatLocaleString ()
#5  0x00000001010b4c30 in GetLocaleExceptionMessage ()
#6  0x00000001010b5ded in ThrowMagickExceptionList ()
#7  0x00000001010b607e in ThrowMagickException ()
#8  0x00000001012783ad in MagickPNGErrorHandler ()
#9  0x000000010075668c in png_longjmp ()
#10 0x00000001012783ba in MagickPNGErrorHandler ()
#11 0x00000001003ad595 in png_error ()
#12 0x00000001003a5006 in png_create_read_struct_2 ()
#13 0x000000010127a310 in ReadOnePNGImage ()
#14 0x00000001012834db in ReadPNGImage ()
#15 0x000000010104ddc2 in ReadImage ()
#16 0x000000010104ee89 in ReadImages ()
#17 0x000000010030b407 in XS_Image__Magick__Q16_Read ()
#18 0x00000001000a7a23 in Perl_pp_entersub ()
#19 0x000000010009f24a in Perl_runops_standard ()
#20 0x00000001000260f9 in perl_run ()
#21 0x0000000100002ddb in main ()

Any suggestions? Could be the problem with my libpng, since I can't successfully read any PNG image, but it should not lead to segfault...

[magick]

The problem may be a PNG version problem. We're running 1.6.3 and your image returns a reasonable exception:

• Exception 450: Read Exception `test.png' @ error/png.c/MagickPNGErrorHandler/1804

In the mean-time we have contacted the PNG developer and hopefully he will comment on this problem.

[newsanon]

We're running 1.6.3

I'm running 1.5.17 (installed through MacPorts).

[glennrp]

What do you get with "convert -list format | grep PNG"? Should say "(1.5.17)" if that's what you are running.

An immediate crash for all PNG files suggests some mixup with the libpng library (building code
with one version and running with another).

If PerlMagick has some equivalent way of doing "-list format", what does that say? Sorry I don't
use PerlMagick.

[magick]

Unfortunately we cannot reproduce the problem and we have not heard from anyone else about this problem. We tried your script on our Mac OS X host and it ran without complaint.