memory corrupt when load invalid image
Posted: 2011-01-27T12:33:55-07:00
Hi,
I try to load a memory image by using BlobToImage. It causes access violation error when loading an invalid image. I wonder if I missed image format checking or something. Any help will be greatly appreciated.
my env:
ImageMagick version: 6.6.7
Build in MS VS 10.
Running under win 2008 R2
From debug, it looks like the problem is at ThrowException when call p=(ExceptionInfo *) GetLastValueInLinkedList((LinkedListInfo *)
error message is: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
The following is my test case. The logo.esp file is from the Image fold of ImageMagick source package.
I try to load a memory image by using BlobToImage. It causes access violation error when loading an invalid image. I wonder if I missed image format checking or something. Any help will be greatly appreciated.
my env:
ImageMagick version: 6.6.7
Build in MS VS 10.
Running under win 2008 R2
From debug, it looks like the problem is at ThrowException when call p=(ExceptionInfo *) GetLastValueInLinkedList((LinkedListInfo *)
error message is: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
The following is my test case. The logo.esp file is from the Image fold of ImageMagick source package.
Code: Select all
#include <stdio.h>
#include <stdlib.h>
#include "magick/MagickCore.h"
int main(int argc, char** argv)
{
FILE* file = NULL;
//load a bogus file
if( fopen_s( &file, "logo.eps", "rb" ) != 0)
{
printf("load file error");
exit(1);
}
fseek(file, 0, SEEK_END);
size_t length = ftell(file);
fseek(file, 0, SEEK_SET);
BYTE* databyte = new BYTE[length];
int rlength = fread(databyte, 1, length, file);
Image* image = NULL;
ImageInfo *image_info;
ExceptionInfo exception;
image_info = CloneImageInfo(NULL);
if (!image_info)
{
return 0;
}
try
{
//image = PingBlob(image_info, databyte, length , &exception);
image = BlobToImage(image_info, databyte, length, &exception);
}
catch(...)
{
return 1;
}
delete [] databyte;
fclose(file);
if(image != NULL)
{
DestroyImage(image);
}
return 0;
}