Heap buffer overflow in TracePoint()

Post any defects you find in the released or beta versions of the ImageMagick software here. Include the ImageMagick version, OS, and any command-line required to reproduce the problem. Got a patch for a bug? Post it here.
Post Reply
fumfel
Posts: 12
Joined: 2016-09-20T06:30:11-07:00
Authentication code: 1151

Heap buffer overflow in TracePoint()

Post by fumfel »

After some fuzz testing I found a crashing test case.

Git HEAD: b0323e6509f4530a228c8788db11a49ff9255b69

OS & Compiler: Ubuntu 16.04 x64 + Clang 4.0

Command:

Code: Select all

 convert im_hbo_TracePoint /dev/null
Faulting input: https://frankowicz.me/storage/crashes/i ... ePoint.svg

ASAN:

Code: Select all

==21950==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f17a55597f8 at pc 0x7f17b0db90f8 bp 0x7ffeddc90d50 sp 0x7ffeddc90d48
WRITE of size 8 at 0x7f17a55597f8 thread T0
    #0 0x7f17b0db90f7 in TracePoint XYZ/ImageMagick/MagickCore/draw.c:1667:30
    #1 0x7f17b0db90f7 in TraceEllipse XYZ/ImageMagick/MagickCore/draw.c:5393
    #2 0x7f17b0dab80b in TraceCircle XYZ/ImageMagick/MagickCore/draw.c:5351:3
    #3 0x7f17b0dab80b in DrawImage XYZ/ImageMagick/MagickCore/draw.c:3128
    #4 0x7f17b14e8692 in ReadMVGImage XYZ/ImageMagick/coders/mvg.c:221:10
    #5 0x7f17b0cdafa4 in ReadImage XYZ/ImageMagick/MagickCore/constitute.c:497:13
    #6 0x7f17b15f994a in ReadSVGImage XYZ/ImageMagick/coders/svg.c:3273:13
    #7 0x7f17b0cdafa4 in ReadImage XYZ/ImageMagick/MagickCore/constitute.c:497:13
    #8 0x7f17b0cde661 in ReadImages XYZ/ImageMagick/MagickCore/constitute.c:866:9
    #9 0x7f17b02e81d1 in ConvertImageCommand XYZ/ImageMagick/MagickWand/convert.c:641:18
    #10 0x7f17b04a4125 in MagickCommandGenesis XYZ/ImageMagick/MagickWand/mogrify.c:183:14
    #11 0x4ee3e9 in MagickMain XYZ/ImageMagick/utilities/magick.c:149:10
    #12 0x4ee3e9 in main XYZ/ImageMagick/utilities/magick.c:180
    #13 0x7f17abd0282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #14 0x41a338 in _start (/usr/local/bin/magick+0x41a338)

0x7f17a55597f8 is located 16 bytes to the right of 262120-byte region [0x7f17a5519800,0x7f17a55597e8)
allocated by thread T0 here:
    #0 0x4c103c in __interceptor_malloc /scratch/llvm/clang-4/xenial/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:66:3
    #1 0x7f17b0f5e9a4 in AcquireMagickMemory XYZ/ImageMagick/MagickCore/memory.c:464:10
    #2 0x7f17b0f5e9a4 in AcquireQuantumMemory XYZ/ImageMagick/MagickCore/memory.c:537
    #3 0x7f17b14e8692 in ReadMVGImage XYZ/ImageMagick/coders/mvg.c:221:10
    #4 0x7f17b0cdafa4 in ReadImage XYZ/ImageMagick/MagickCore/constitute.c:497:13
    #5 0x7f17b15f994a in ReadSVGImage XYZ/ImageMagick/coders/svg.c:3273:13
    #6 0x7f17b0cdafa4 in ReadImage XYZ/ImageMagick/MagickCore/constitute.c:497:13
    #7 0x7f17b0cde661 in ReadImages XYZ/ImageMagick/MagickCore/constitute.c:866:9
    #8 0x7f17b02e81d1 in ConvertImageCommand XYZ/ImageMagick/MagickWand/convert.c:641:18
    #9 0x7f17b04a4125 in MagickCommandGenesis XYZ/ImageMagick/MagickWand/mogrify.c:183:14
    #10 0x4ee3e9 in MagickMain XYZ/ImageMagick/utilities/magick.c:149:10
    #11 0x4ee3e9 in main XYZ/ImageMagick/utilities/magick.c:180
    #12 0x7f17abd0282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow XYZ/ImageMagick/MagickCore/draw.c:1667:30 in TracePoint
Shadow bytes around the buggy address:
  0x0fe374aa32a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe374aa32b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe374aa32c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe374aa32d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe374aa32e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0fe374aa32f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa[fa]
  0x0fe374aa3300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe374aa3310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe374aa3320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe374aa3330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe374aa3340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==21950==ABORTING
Regards,
Kamil Frankowicz
Top
User avatar
dlemstra
Posts: 1570
Joined: 2013-05-04T15:28:54-07:00
Authentication code: 6789
Contact:
Contact dlemstra

Re: Heap buffer overflow in TracePoint()

Post by dlemstra »

Could you open a github issue for this?
.NET + ImageMagick = Magick.NET https://github.com/dlemstra/Magick.NET, @MagickNET, Donate
Top
User avatar
magick
Site Admin
Posts: 11064
Joined: 2003-05-31T11:32:55-07:00

Re: Heap buffer overflow in TracePoint()

Post by magick »

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.
Top
Post Reply

Return to “Bugs”