Menu

#485 NULL pointer dereference in NTGetTypeList

v1.0_(example)
closed-fixed
None
5
2017-09-30
2017-09-25
bestshow
No

Here is the critical code: (in NTGetTypeList)

type_array = MagickAllocateMemory(TypeInfo**,sizeof(TypeInfo*)*list_entries); //560

    while (type_list->previous != (TypeInfo *) NULL)
      type_list=type_list->previous;

    for (array_index=0; array_index< list_entries; array_index++)
      {
        type_array[array_index] = type_list;
        type_list=type_list->next;
      }

MagickAllocateMemory(...) may return NULL, so the following operations on the "type_array" will Dereference Null pointer to cause memory error.

Credit : ADLab of Venustech

Discussion

  • Bob Friesenhahn

    Bob Friesenhahn - 2017-09-30
    • status: open --> closed-fixed
    • assigned_to: Bob Friesenhahn
     
  • Bob Friesenhahn

    Bob Friesenhahn - 2017-09-30

    This problem is fixed by Mercurial changeset 15191:1d246051bda3. Thanks for the report!

     

Log in to post a comment.