undefined behaviors in convert
Posted: 2015-06-11T16:03:28-07:00
I have found several undefined behaviors in convert.
Following is the command to reproduce them.
First you should build ImageMagick with ubsan (require gcc-4.9 or clang-3.3)
and the version I'm testing is ImageMagick-6.9.1-4.
Link for test files are
http://xiedingbao.github.io/tmp/1 Error information: coders/bmp.c:737:35: runtime error: division by zero
http://xiedingbao.github.io/tmp/2 Error information:coders/bmp.c:751:36: runtime error: division by zero
http://xiedingbao.github.io/tmp/3Error information: coders/bmp.c:1038:37: runtime error: shift exponent 32 is too large for 32-bit type 'unsigned int'
http://xiedingbao.github.io/tmp/4Error information: coders/bmp.c:744:37: runtime error: division by zero
Following is the command to reproduce them.
First you should build ImageMagick with ubsan (require gcc-4.9 or clang-3.3)
and the version I'm testing is ImageMagick-6.9.1-4.
Code: Select all
convert test_file a.ppm
http://xiedingbao.github.io/tmp/1 Error information: coders/bmp.c:737:35: runtime error: division by zero
http://xiedingbao.github.io/tmp/2 Error information:coders/bmp.c:751:36: runtime error: division by zero
http://xiedingbao.github.io/tmp/3Error information: coders/bmp.c:1038:37: runtime error: shift exponent 32 is too large for 32-bit type 'unsigned int'
http://xiedingbao.github.io/tmp/4Error information: coders/bmp.c:744:37: runtime error: division by zero