*** glibc detected *** identify: double free or corruption

[Norm]

When handling a corrupt pict image ( http://bugs.debian.org/cgi-bin/bugrepor ... bug=414370 ) on ImageMagick versions ranging from 6.0.7-18 to 6.3.7-10 on a range of releases up to Fedora 7 & 8 error messages like the following are seen:

# identify deb-broken3.pict
*** glibc detected *** identify: double free or corruption (out): 0x000000000063deb0 ***
======= Backtrace: =========
/lib64/libc.so.6[0x33c4270412]
/lib64/libc.so.6(cfree+0x8c)[0x33c4273b1c]
/usr/lib64/libMagick.so.10(RelinquishMagickMemory+0xe)[0x398fed017e]
/usr/lib64/ImageMagick-6.3.7/modules-Q16/coders/pict.so[0x2aaaaaadc0cc]
/usr/lib64/ImageMagick-6.3.7/modules-Q16/coders/pict.so[0x2aaaaaadd991]
/usr/lib64/libMagick.so.10(ReadImage+0x1f0)[0x398fe5ff20]
/usr/lib64/libWand.so.10(IdentifyImageCommand+0x29d)[0x398fa579ad]
identify[0x400baa]
/lib64/libc.so.6(__libc_start_main+0xf4)[0x33c421dab4]
identify[0x400a29]
======= Memory map: ========
[snip]


Running 6.3.7-10 on F7 in valgrind shows output like:
# valgrind convert deb-broken3.pict /tmp/foo.jpg
==6065== Memcheck, a memory error detector.
==6065== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==6065== Using LibVEX rev 1732, a library for dynamic binary translation.
==6065== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==6065== Using valgrind-3.2.3, a dynamic binary instrumentation framework.
==6065== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==6065== For more details, rerun with: -v
==6065==
==6065== Invalid write of size 1
==6065== at 0x4A07629: memcpy (mc_replace_strmem.c:406)
==6065== by 0x503922B: DecodeImage (pict.c:541)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065== Address 0x4EB3CC2 is 0 bytes after a block of size 32,778 alloc'd
==6065== at 0x4A05996: malloc (vg_replace_malloc.c:149)
==6065== by 0x5038F62: DecodeImage (pict.c:482)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Invalid write of size 1
==6065== at 0x4A07632: memcpy (mc_replace_strmem.c:406)
==6065== by 0x503922B: DecodeImage (pict.c:541)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065== Address 0x4EB3CC3 is 1 bytes after a block of size 32,778 alloc'd
==6065== at 0x4A05996: malloc (vg_replace_malloc.c:149)
==6065== by 0x5038F62: DecodeImage (pict.c:482)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Invalid write of size 1
==6065== at 0x4A07618: memcpy (mc_replace_strmem.c:406)
==6065== by 0x503922B: DecodeImage (pict.c:541)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065== Address 0x4EB3CC4 is 2 bytes after a block of size 32,778 alloc'd
==6065== at 0x4A05996: malloc (vg_replace_malloc.c:149)
==6065== by 0x5038F62: DecodeImage (pict.c:482)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Invalid write of size 1
==6065== at 0x4A07620: memcpy (mc_replace_strmem.c:406)
==6065== by 0x503922B: DecodeImage (pict.c:541)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065== Address 0x4EB3CC5 is 3 bytes after a block of size 32,778 alloc'd
==6065== at 0x4A05996: malloc (vg_replace_malloc.c:149)
==6065== by 0x5038F62: DecodeImage (pict.c:482)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Invalid write of size 1
==6065== at 0x4A07618: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065== Address 0x4EB3EC8 is not stack'd, malloc'd or (recently) free'd
==6065==
==6065== Invalid write of size 1
==6065== at 0x4A07620: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065== Address 0x4EB3EC9 is not stack'd, malloc'd or (recently) free'd
==6065==
==6065== Invalid write of size 1
==6065== at 0x4A07629: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065== Address 0x4EB3ECA is not stack'd, malloc'd or (recently) free'd
==6065==
==6065== Invalid write of size 1
==6065== at 0x4A07632: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065== Address 0x4EB3ECB is not stack'd, malloc'd or (recently) free'd
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x503914D: DecodeImage (pict.c:525)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x5038971: ExpandBuffer (pict.c:402)
==6065== by 0x503917D: DecodeImage (pict.c:529)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x50389F7: ExpandBuffer (pict.c:402)
==6065== by 0x503917D: DecodeImage (pict.c:529)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x398FED01A1: CopyMagickMemory (memory.c:438)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x398FED01B0: CopyMagickMemory (memory.c:442)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x398FED01B9: CopyMagickMemory (memory.c:442)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x4A074FA: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x4A07519: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x4A0760C: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x4A0763E: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x4A0764B: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x503919C: DecodeImage (pict.c:524)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Use of uninitialised value of size 8
==6065== at 0x5039148: DecodeImage (pict.c:525)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Use of uninitialised value of size 8
==6065== at 0x5038984: ExpandBuffer (pict.c:404)
==6065== by 0x503917D: DecodeImage (pict.c:529)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Use of uninitialised value of size 8
==6065== at 0x5038992: ExpandBuffer (pict.c:405)
==6065== by 0x503917D: DecodeImage (pict.c:529)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Use of uninitialised value of size 8
==6065== at 0x503899F: ExpandBuffer (pict.c:406)
==6065== by 0x503917D: DecodeImage (pict.c:529)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Use of uninitialised value of size 8
==6065== at 0x50389AC: ExpandBuffer (pict.c:407)
==6065== by 0x503917D: DecodeImage (pict.c:529)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Use of uninitialised value of size 8
==6065== at 0x50389B9: ExpandBuffer (pict.c:408)
==6065== by 0x503917D: DecodeImage (pict.c:529)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Use of uninitialised value of size 8
==6065== at 0x50389C6: ExpandBuffer (pict.c:409)
==6065== by 0x503917D: DecodeImage (pict.c:529)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Use of uninitialised value of size 8
==6065== at 0x50389D3: ExpandBuffer (pict.c:410)
==6065== by 0x503917D: DecodeImage (pict.c:529)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Use of uninitialised value of size 8
==6065== at 0x50389DF: ExpandBuffer (pict.c:411)
==6065== by 0x503917D: DecodeImage (pict.c:529)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x398FED0197: CopyMagickMemory (memory.c:436)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x398FED01A6: CopyMagickMemory (memory.c:438)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x4A07503: memcpy (mc_replace_strmem.c:77)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x4A075E2: memcpy (mc_replace_strmem.c:80)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x4A0757E: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Conditional jump or move depends on uninitialised value(s)
==6065== at 0x4A07600: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Use of uninitialised value of size 8
==6065== at 0x4A07618: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Use of uninitialised value of size 8
==6065== at 0x4A07620: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Use of uninitialised value of size 8
==6065== at 0x4A07629: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
==6065==
==6065== Use of uninitialised value of size 8
==6065== at 0x4A07632: memcpy (mc_replace_strmem.c:406)
==6065== by 0x5039190: DecodeImage (pict.c:530)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)
--6065-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--6065-- si_code=80; Faulting address: 0x0; sp: 0x402B8BDA0

valgrind: the 'impossible' happened:
Killed by fatal signal
==6065== at 0x3802047C: vgPlain_arena_free (m_mallocfree.c:190)
==6065== by 0x380358EF: vgPlain_cli_free (replacemalloc_core.c:108)
==6065== by 0x38001839: die_and_free_mem (mc_malloc_wrappers.c:111)
==6065== by 0x38035F97: do_client_request (scheduler.c:1158)
==6065== by 0x380376A1: vgPlain_scheduler (scheduler.c:869)
==6065== by 0x380530A9: run_a_thread_NORETURN (syswrap-linux.c:87)

sched status:
running_tid=1

Thread 1: status = VgTs_Runnable
==6065== at 0x4A055AB: free (vg_replace_malloc.c:233)
==6065== by 0x398FED017D: RelinquishMagickMemory (memory.c:589)
==6065== by 0x50390CB: DecodeImage (pict.c:547)
==6065== by 0x503A990: ReadPICTImage (pict.c:1152)
==6065== by 0x398FE5FF1F: ReadImage (constitute.c:386)
==6065== by 0x398FA2DDE2: ConvertImageCommand (convert.c:560)
==6065== by 0x400D6B: main (convert.c:122)


Note: see also the FAQ.txt in the source distribution.
It contains workarounds to several common problems.

If that doesn't help, please report this bug to: http://www.valgrind.org

In the bug report, send all the above text, the valgrind
version, and what Linux distro you are using. Thanks.

#

If there's anything I can do to help narrow this down further, let me know.

[magick]

We have a patch for this problem in ImageMagick 6.3.8-0 Beta available sometime tomorrow. Thanks for the problem report.