out-of-bounds read in magick/image.c:1305:3
Swiss army knife of image processing
Brought to you by:
bfriesen
Menu
▾
▴
1 Attachments
#365 out-of-bounds read in magick/image.c:1305:3
This bug was found while fuzzing graphicsmagick with afl-fuzz
Tested on hg changeset 44ed8318ba6a+
Command: gm convert id:000070,sig:06,src:000690,op:flip1,pos:1105 /dev/null
=================================================================
==16949==ERROR: AddressSanitizer: heap-use-after-free on address 0xb430c1d0 at pc 0x0825f4f8 bp 0xbfd05e48 sp 0xbfd05e40
READ of size 4 at 0xb430c1d0 thread T0
#0 0x825f4f7 in DestroyImageInfo /home/user/Desktop/graphicsmagick/magick/image.c:1305:3
#1 0x84ae5c5 in ReadPICTImage /home/user/Desktop/graphicsmagick/coders/pict.c:963:15
#2 0x81f84b4 in ReadImage /home/user/Desktop/graphicsmagick/magick/constitute.c:1607:14
#3 0x816fbca in ConvertImageCommand /home/user/Desktop/graphicsmagick/magick/command.c:4348:22
#4 0x8187f6b in MagickCommand /home/user/Desktop/graphicsmagick/magick/command.c:8862:27
#5 0x81cd999 in GMCommandSingle /home/user/Desktop/graphicsmagick/magick/command.c:17338:10
#6 0x81cc6ae in GMCommand /home/user/Desktop/graphicsmagick/magick/command.c:17391:16
#7 0x8139511 in main /home/user/Desktop/graphicsmagick/utilities/gm.c:61:10
#8 0xb749173d in __libc_start_main /build/glibc-tVsQx_/glibc-2.21/csu/libc-start.c:289
#9 0x807fd9b in _start (/home/user/Desktop/graphicsmagick/utilities/gm+0x807fd9b)
0xb430c1d0 is located 8400 bytes inside of 8404-byte region [0xb430a100,0xb430c1d4)
freed by thread T0 here:
#0 0x81176e9 in __interceptor_free (/home/user/Desktop/graphicsmagick/utilities/gm+0x81176e9)
#1 0x827f285 in MagickFree /home/user/Desktop/graphicsmagick/magick/memory.c:509:6
previously allocated by thread T0 here:
#0 0x8117a29 in malloc (/home/user/Desktop/graphicsmagick/utilities/gm+0x8117a29)
#1 0x827e984 in MagickMalloc /home/user/Desktop/graphicsmagick/magick/memory.c:156:11
#2 0x81f84b4 in ReadImage /home/user/Desktop/graphicsmagick/magick/constitute.c:1607:14
#3 0x816fbca in ConvertImageCommand /home/user/Desktop/graphicsmagick/magick/command.c:4348:22
#4 0x8187f6b in MagickCommand /home/user/Desktop/graphicsmagick/magick/command.c:8862:27
#5 0x81cd999 in GMCommandSingle /home/user/Desktop/graphicsmagick/magick/command.c:17338:10
#6 0x81cc6ae in GMCommand /home/user/Desktop/graphicsmagick/magick/command.c:17391:16
#7 0x8139511 in main /home/user/Desktop/graphicsmagick/utilities/gm.c:61:10
SUMMARY: AddressSanitizer: heap-use-after-free /home/user/Desktop/graphicsmagick/magick/image.c:1305 DestroyImageInfo
Shadow bytes around the buggy address:
0x368617e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x368617f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x36861800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x36861810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x36861820: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x36861830: fd fd fd fd fd fd fd fd fd fd[fd]fa fa fa fa fa
0x36861840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x36861850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x36861860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x36861870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x36861880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==16949==ABORTING
Diff:
This problem is fixed by Mercurial changeset 14748:c4bab23e886e