Use after free in GetPixelInfoPixel()

Post any defects you find in the released or beta versions of the ImageMagick software here. Include the ImageMagick version, OS, and any command-line required to reproduce the problem. Got a patch for a bug? Post it here.
Post Reply
fumfel
Posts: 12
Joined: 2016-09-20T06:30:11-07:00
Authentication code: 1151

Use after free in GetPixelInfoPixel()

Post by fumfel »

After some fuzz testing I found a crashing test case.

Git HEAD: f0d6dde21d77905c0c3769c2d3491365d518c844

OS & Compiler: Ubuntu 16.04 x64 + Clang 4.0

Crashing file: https://frankowicz.me/storage/crashes/i ... lInfoPixel

Command:

Code: Select all

convert im_uaf_GetPixelInfoPixel /dev/null
ASAN:

Code: Select all

==32276==ERROR: AddressSanitizer: heap-use-after-free on address 0x60a000052280 at pc 0x7fd55232959f bp 0x7ffc44567b30 sp 0x7ffc44567b28
READ of size 4 at 0x60a000052280 thread T0
    #0 0x7fd55232959e in GetPixelInfoPixel XYZ/ImageMagick/./MagickCore/pixel-accessor.h:385:5
    #1 0x7fd55232959e in InterpolatePixelInfo XYZ/ImageMagick/MagickCore/pixel.c:5716
    #2 0x7fd55248f4fa in ResamplePixelColor XYZ/ImageMagick/MagickCore/resample.c:455:16
    #3 0x7fd5520a00af in .omp_outlined. XYZ/ImageMagick/MagickCore/distort.c:2714:18
    #4 0x7fd54d3f5af2 in __kmp_invoke_microtask (/usr/local/lib/libomp.so+0x77af2)
    #5 0x7fd54d3ab78b in __kmp_invoke_task_func (/usr/local/lib/libomp.so+0x2d78b)
    #6 0x7fd54d3a7e97 in __kmp_fork_call (/usr/local/lib/libomp.so+0x29e97)
    #7 0x7fd54d39d21f in __kmpc_fork_call (/usr/local/lib/libomp.so+0x1f21f)
    #8 0x7fd552092122 in DistortImage XYZ/ImageMagick/MagickCore/distort.c:2318:13
    #9 0x7fd5520a2cda in RotateImage XYZ/ImageMagick/MagickCore/distort.c:2836:16
    #10 0x7fd552978fda in ReadWPGImage XYZ/ImageMagick/coders/wpg.c:1210:36
    #11 0x7fd551ff09c4 in ReadImage XYZ/ImageMagick/MagickCore/constitute.c:497:13
    #12 0x7fd551ff40d1 in ReadImages XYZ/ImageMagick/MagickCore/constitute.c:866:9
    #13 0x7fd5515ff9e7 in ConvertImageCommand XYZ/ImageMagick/MagickWand/convert.c:641:18
    #14 0x7fd5517bc256 in MagickCommandGenesis XYZ/ImageMagick/MagickWand/mogrify.c:183:14
    #15 0x4e5ed5 in MagickMain XYZ/ImageMagick/utilities/magick.c:149:10
    #16 0x4e5ed5 in main XYZ/ImageMagick/utilities/magick.c:180
    #17 0x7fd54cdbe82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #18 0x419bc8 in _start (/usr/local/bin/magick+0x419bc8)

0x60a000052280 is located 0 bytes inside of 64-byte region [0x60a000052280,0x60a0000522c0)
freed by thread T3 here:
    #0 0x4b808b in __interceptor_free /home/llvm/clang-3.9/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:47:3
    #1 0x7fd55227c756 in RelinquishAlignedMemory XYZ/ImageMagick/MagickCore/memory.c:1006:3

previously allocated by thread T0 here:
    #0 0x4b8e87 in __interceptor_posix_memalign /home/llvm/clang-3.9/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:130:3
    #1 0x7fd55227a734 in AcquireAlignedMemory XYZ/ImageMagick/MagickCore/memory.c:262:7
    #2 0x7fd551f37cd3 in AcquireCacheNexusPixels XYZ/ImageMagick/MagickCore/cache.c:4705:37
    #3 0x7fd551f37cd3 in SetPixelCacheNexusPixels XYZ/ImageMagick/MagickCore/cache.c:4825

Thread T3 created by T0 here:
    #0 0x4a07b6 in pthread_create /home/llvm/clang-3.9/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:245:3
    #1 0x7fd54d3c2fe4 in __kmp_create_worker (/usr/local/lib/libomp.so+0x44fe4)

SUMMARY: AddressSanitizer: heap-use-after-free XYZ/ImageMagick/./MagickCore/pixel-accessor.h:385:5 in GetPixelInfoPixel
Shadow bytes around the buggy address:
  0x0c1480002400: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c1480002410: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c1480002420: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c1480002430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1480002440: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
=>0x0c1480002450:[fd]fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c1480002460: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c1480002470: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c1480002480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1480002490: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c14800024a0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==32276==ABORTING
Regards,
Kamil Frankowicz
Top
User avatar
magick
Site Admin
Posts: 11064
Joined: 2003-05-31T11:32:55-07:00

Re: Use after free in GetPixelInfoPixel()

Post by magick »

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ https://www.imagemagick.org/download/beta/ by sometime tomorrow.
Top
Post Reply

Return to “Bugs”