assertion failure in magick/pixel_cache.c:1089
Swiss army knife of image processing
Brought to you by:
bfriesen
Already reported via mail, posting it for tracking purpose:
gm: magick/pixel_cache.c:1089: const PixelPacket AcquireImagePixels(const
Image , const long, const long, const unsigned long, const unsigned long,
ExceptionInfo ): Assertion `image != (Image ) NULL' failed.
Reproducer attached (png is just a random extension).
GraphicsMagick 1.4 snapshot-20170710 Q8 http://www.GraphicsMagick.org/
(I built it yesterday, dunno why it report July)
This is a JNG reader issue. I hope that Glenn will fix it.
gm convert -debug coder,exception 20.crashes.png null:
14:36:50 0:01 0.000u 18277 constitute.c/ReadImage/1601/Coder:
Invoking "JNG" decoder (JPEG Network Graphics) subimage=0 subrange=0
14:36:50 0:01 0.000u 18277 png.c/ReadJNGImage/3699/Coder:
enter ReadJNGImage()
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3033/Coder:
enter ReadOneJNGImage()
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3089/Coder:
Reading JNG chunk type JHDR, length: 16
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3093/Coder:
count=4
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3142/Coder:
jng_width: 1
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3145/Coder:
jng_height: 1
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3148/Coder:
jng_color_type: 255
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3151/Coder:
jng_image_sample_depth: 255
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3154/Coder:
jng_image_compression_method: 0
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3157/Coder:
jng_image_interlace_method: 0
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3160/Coder:
jng_alpha_sample_depth: 0
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3163/Coder:
jng_alpha_compression_method: 0
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3166/Coder:
jng_alpha_filter_method: 0
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3169/Coder:
jng_alpha_interlace_method: 0
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3089/Coder:
Reading JNG chunk type sRGB, length: 1
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3093/Coder:
count=4
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3089/Coder:
Reading JNG chunk type pHYs, length: 9
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3093/Coder:
count=4
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3089/Coder:
Reading JNG chunk type vpAg, length: 9
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3093/Coder:
count=4
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3089/Coder:
Reading JNG chunk type JDAT, length: 160
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3093/Coder:
count=4
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3226/Coder:
Creating color_blob.
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3260/Coder:
Creating alpha_blob.
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3277/Coder:
Writing IHDR chunk to alpha_blob.
14:36:50 0:01 0.000u 18277 png.c/LogPNGChunk/672/Coder:
Writing IHDR chunk, length: 13
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3305/Coder:
Copying 160 bytes of JDAT chunk data to color_blob.
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3089/Coder:
Reading JNG chunk type IEND, length: 0
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3093/Coder:
count=4
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3515/Coder:
Reading jng_image from color_blob.
14:36:50 0:01 0.000u 18277 constitute.c/ReadImage/1601/Coder:
Invoking "JPEG" decoder (Joint Photographic Experts Group JFIF format) subimage=0 subrange=0
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: "Start of Image"
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: "JFIF APP0 marker: version 1.28, density 28x28 2"
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: "Define Quantization Table 0 precision 0"
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: "Start Of Frame 0xc0: width=1, height=1, components=1"
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: " Component 1: 1hx1v q=0"
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: "Define Huffman Table 0x00"
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: " 1 0 0 0 0 0 0 0"
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: " 0 0 0 0 0 0 0 0"
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: "Define Huffman Table 0x10"
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: " 1 0 0 0 0 0 0 0"
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: " 0 0 0 0 0 0 0 0"
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: "Start Of Scan: 1 components"
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: " Component 1: dc=0 ac=0"
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: " Ss=0, Se=63, Ah=0, Al=0"
14:36:50 0:01 0.000u 18277 jpeg.c/ReadJPEGImage/1129/Coder:
Image resolution set to 28x28 PixelsPerCentimeter
14:36:50 0:01 0.000u 18277 jpeg.c/ReadJPEGImage/1260/Coder:
Interlace: nonprogressive
14:36:50 0:01 0.000u 18277 jpeg.c/ReadJPEGImage/1262/Coder:
Data precision: 8
14:36:50 0:01 0.000u 18277 jpeg.c/ReadJPEGImage/1264/Coder:
Components: 1
14:36:50 0:01 0.000u 18277 jpeg.c/ReadJPEGImage/1266/Coder:
Geometry: 1x1
14:36:50 0:01 0.000u 18277 jpeg.c/ReadJPEGImage/1269/Coder:
DCT Method: 0
14:36:50 0:01 0.000u 18277 jpeg.c/ReadJPEGImage/1271/Coder:
Fancy Upsampling: true
14:36:50 0:01 0.000u 18277 jpeg.c/ReadJPEGImage/1273/Coder:
Block Smoothing: true
14:36:50 0:01 0.000u 18277 jpeg.c/EstimateJPEGQuality/876/Coder:
Quality: 75 (approximate)
14:36:50 0:01 0.000u 18277 jpeg.c/ReadJPEGImage/1293/Coder:
Colorspace: GRAYSCALE (1)
14:36:50 0:01 0.000u 18277 jpeg.c/ReadJPEGImage/1300/Coder:
Sampling Factors: 1x1
14:36:50 0:01 0.000u 18277 jpeg.c/JPEGMessageHandler/279/Coder:
[/scratch/bfriesen/tmp/gmAlka0u] JPEG Trace: "End Of Image"
14:36:50 0:01 0.000u 18277 jpeg.c/ReadJPEGImage/1521/Coder:
return
14:36:50 0:01 0.000u 18277 constitute.c/ReadImage/1612/Coder:
Returned from "JPEG" decoder: frames=1 cache=present monochrome=False grayscale=False class=PseudoClass colorspace=RGB
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3538/Coder:
Copying jng_image pixels to main image.
14:36:50 0:01 0.000u 18277 png.c/LogPNGChunk/672/Coder:
Writing IEND chunk, length: 0
14:36:50 0:01 0.000u 18277 png.c/ReadOneJNGImage/3569/Coder:
Reading opacity from alpha_blob.
14:36:50 0:01 0.000u 18277 constitute.c/ReadImage/1601/Coder:
Invoking "PNG" decoder (Portable Network Graphics) subimage=0 subrange=0
14:36:50 0:01 0.010u 18277 png.c/ReadPNGImage/2820/Coder:
enter ReadPNGImage()
14:36:50 0:01 0.010u 18277 png.c/ReadPNGImage/2841/CorruptImage:
Insufficient image data in file (/scratch/bfriesen/tmp/gm5j37dY)
14:36:50 0:01 0.010u 18277 constitute.c/ReadImage/1622/Coder:
Returned from "PNG" decoder, returned image is NULL!
gm: ...pixel_cache.c:1089: AcquireImagePixels: Assertion `image != (Image *) NULL' failed.
gm convert: abort due to signal 6 (SIGABRT) "Abort"...
Confirmed that this file causes my GM to segfault.
pngcheck says:
Last edit: Glenn Randers-Pehrson 2017-08-23
This one was fixed by Mercurial changeset 15141:358608a46f0a on August 29th.
https://nvd.nist.gov/vuln/detail/CVE-2017-14649