#437 assertion failure in WriteBlob

[bestshow]

On GraphicsMagick 1.3.26 2017-07-04 Q8

An assertion failure vulnerability was found in function WriteBlob ,which allow attackers to cause a denial of service via a crafted file.

#./gm identify $FILE
gm: magick/blob.c:4607: size_t WriteBlob(Image *, const size_t, const void *): Assertion `data != (const char *) ((void*)0)' failed.
/home/test/Downloads/IM-GM-build/bin/gm identify: abort due to signal 6 (SIGABRT) "Abort"...
Aborted

The poc file is in the attachment.

Credit: ADLab of Venustech

[Bob Friesenhahn]

This issue can no longer be reproduced with current GraphicsMagick sources.

[Agostino Sarubbo]

I hit this issue too, but I did not post it because it is not reproducible with the current master.

[bestshow]

Agostino Sarubbo, it is reproducible when I tested this issue.

[Agostino Sarubbo]

you're right, my comment want to confirm that was reproducible with 1.3.26 and unreproducible now ( this not means that is fixed, but just unreachable)

[Trace Probe]

seems like the assertion is still reachable in changeset 15622 with other commands.

Run: ./bin/gm convert -negate -clip $POC. with the attached file

[Bob Friesenhahn]

This is in response to "Trace Probe"'s glomming onto this report. While I did not reproduce the assertion, I did notice an excessively large memory allocation and added extra validations. The changes are included in 15623:d97a40634bef

In the future, please open new problem reports for new problematic input files.