Heap out of bounds read in .omp_outlined..68()

Post any defects you find in the released or beta versions of the ImageMagick software here. Include the ImageMagick version, OS, and any command-line required to reproduce the problem. Got a patch for a bug? Post it here.
Post Reply
fumfel
Posts: 12
Joined: 2016-09-20T06:30:11-07:00
Authentication code: 1151

Heap out of bounds read in .omp_outlined..68()

Post by fumfel »

After some fuzz testing I found a crashing test case.

Git HEAD: eb56534ac870d9a5b8a6e7db8d32c0e76ae65924

OS & Compiler: Ubuntu 16.04 x64 + Clang 4.0

Command:

Code: Select all

convert im_hoobr_omp_outlined.eps null
Faulting input: https://frankowicz.me/storage/crashes/i ... tlined.eps

ASAN:

Code: Select all

==13673==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f76c11975f0 at pc 0x7f76cac64336 bp 0x7ffc70784a50 sp 0x7ffc70784a48
READ of size 4 at 0x7f76c11975f0 thread T0
    #0 0x7f76cac64335 in .omp_outlined..68 XYZ/ImageMagick/MagickCore/resize.c:2820:28
    #1 0x7f76c76cf6b2 in __kmp_invoke_microtask (/usr/local/lib/libomp.so+0x776b2)
    #2 0x7f76c76891fb in __kmp_invoke_task_func (/usr/local/lib/libomp.so+0x311fb)
    #3 0x7f76c768575c in __kmp_fork_call (/usr/local/lib/libomp.so+0x2d75c)
    #4 0x7f76c767ae3f in __kmpc_fork_call (/usr/local/lib/libomp.so+0x22e3f)
    #5 0x7f76cac5cfc2 in VerticalFilter XYZ/ImageMagick/MagickCore/resize.c:2700:11
    #6 0x7f76cac5b7aa in ResizeImage XYZ/ImageMagick/MagickCore/resize.c:2957:14
    #7 0x7f76caf3c649 in WriteEPTImage XYZ/ImageMagick/coders/ept.c:444:20
    #8 0x7f76caa4b043 in WriteImage XYZ/ImageMagick/MagickCore/constitute.c:1114:14
    #9 0x7f76caa4bacf in WriteImages XYZ/ImageMagick/MagickCore/constitute.c:1333:13
    #10 0x7f76ca28135e in ConvertImageCommand XYZ/ImageMagick/MagickWand/convert.c:3280:11
    #11 0x7f76ca35fd22 in MagickCommandGenesis XYZ/ImageMagick/MagickWand/mogrify.c:183:14
    #12 0x4edaee in MagickMain XYZ/ImageMagick/utilities/magick.c:149:10
    #13 0x7f76c709882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #14 0x419ff8 in _start (/usr/local/bin/magick+0x419ff8)

0x7f76c11975f0 is located 6672 bytes to the left of 1425792-byte region [0x7f76c1199000,0x7f76c12f5180)
allocated by thread T0 here:
    #0 0x4c1807 in posix_memalign /scratch/llvm/clang-4/xenial/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:142:3
    #1 0x7f76cabb20ba in AcquireAlignedMemory XYZ/ImageMagick/MagickCore/memory.c:262:7
    #2 0x7f76ca9e6735 in OpenPixelCache XYZ/ImageMagick/MagickCore/cache.c:3561:46
    #3 0x7f76ca9e94cf in GetImagePixelCache XYZ/ImageMagick/MagickCore/cache.c:1668:18
    #4 0x7f76ca9ec7ad in SyncImagePixelCache XYZ/ImageMagick/MagickCore/cache.c:5266:28
    #5 0x7f76caa0b0e1 in SetImageColorspace XYZ/ImageMagick/MagickCore/colorspace.c:1126:10
    #6 0x7f76cae53a13 in ReadPNMImage XYZ/ImageMagick/coders/pnm.c:402:26
    #7 0x7f76caa48644 in ReadImage XYZ/ImageMagick/MagickCore/constitute.c:497:13
    #8 0x7f76cae5f43c in ReadPSImage XYZ/ImageMagick/coders/ps.c:943:12
    #9 0x7f76caa48644 in ReadImage XYZ/ImageMagick/MagickCore/constitute.c:497:13
    #10 0x7f76ca9cb295 in BlobToImage XYZ/ImageMagick/MagickCore/blob.c:450:9
    #11 0x7f76caf3c0ae in ReadEPTImage XYZ/ImageMagick/coders/ept.c:252:9
    #12 0x7f76caa48644 in ReadImage XYZ/ImageMagick/MagickCore/constitute.c:497:13
    #13 0x7f76caa4a6bc in ReadImages XYZ/ImageMagick/MagickCore/constitute.c:866:9
    #14 0x7f76ca279bb5 in ConvertImageCommand XYZ/ImageMagick/MagickWand/convert.c:641:18
    #15 0x7f76ca35fd22 in MagickCommandGenesis XYZ/ImageMagick/MagickWand/mogrify.c:183:14
    #16 0x4edaee in MagickMain XYZ/ImageMagick/utilities/magick.c:149:10
    #17 0x7f76c709882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow XYZ/ImageMagick/MagickCore/resize.c:2820:28 in .omp_outlined..68
Shadow bytes around the buggy address:
  0x0fef5822ae60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fef5822ae70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fef5822ae80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fef5822ae90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fef5822aea0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0fef5822aeb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa
  0x0fef5822aec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fef5822aed0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fef5822aee0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fef5822aef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fef5822af00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==13673==ABORTING
Regards,
Kamil Frankowicz
Top
User avatar
magick
Site Admin
Posts: 11064
Joined: 2003-05-31T11:32:55-07:00

Re: Heap out of bounds read in .omp_outlined..68()

Post by magick »

Unfortunately we cannot reproduce the problem. We're using the latest Github head, Ubuntu 16.04.3, and gcc 5.4.0. Add --disable-openmp to your configure command-line and install. Does the problem still exhibit for you? Is the problem intermittent or random?
Top
fumfel
Posts: 12
Joined: 2016-09-20T06:30:11-07:00
Authentication code: 1151

Re: Heap out of bounds read in .omp_outlined..68()

Post by fumfel »

With '--disable-openmp' switch, problem doesn't exists.
Regards,
Kamil Frankowicz
Top
Post Reply

Return to “Bugs”