CVE-2019-17541: Use After Free (CWE-416)
value: ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 8.8
Published: 2019-10-14T02:15Z
Repository: https://github.com/ImageMagick/ImageMagick
Language: Other
Files changed: ChangeLog, coders/jpeg.c
Commit date: 2019-07-18 06:24:40 -0400
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1641

Diff: diff --git a/ChangeLog b/ChangeLog
index cba66b8b7feb..52dcc9bc8ab8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,18 +1,25 @@
+2019-07-18  7.0.8-55 Cristy  <quetzlzacatenango@image...>
+  * Release ImageMagick version 7.0.8-55, GIT revision 15...
+
+2019-07-18  7.0.8-55 Cristy  <quetzlzacatenango@image...>
+  * Heap-buffer overflow (reference
+    https://github.com/ImageMagick/ImageMagick/issues/1641
+
 2019-07-16  7.0.8-54 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.8-54, GIT revision 15916:e868e22:20190716.
 
 2019-07-08  7.0.8-54 Cristy  <quetzlzacatenango@image...>
-   * resolve division by zero  (reference
+  * resolve division by zero  (reference
      https://github.com/ImageMagick/ImageMagick/issues/1629).
-   * introducing MagickLevelImageColors() MagickWand method.
+  * introducing MagickLevelImageColors() MagickWand method.
   * Transient problem with text placement with gravity (reference
     https://github.com/ImageMagick/ImageMagick/issues/1633).
   * Support TIM2 image format (reference
     https://github.com/ImageMagick/ImageMagick/pull/1571).
   * For -magnify option, specify an alternative scaling method with -define
-	  magnify:method=method, choose from these methods: eagle2X, eagle3X,
+    magnify:method=method, choose from these methods: eagle2X, eagle3X,
     eagle3XB, epb2X, fish2X, hq2X,  scale2X (default), scale3X, xbr2X.
 
 2019-07-05  7.0.8-53 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.8-53, GIT revision 15828:f5d59c0:20190705.
 
@@ -1486,11 +1493,11 @@
     https://imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588).
 
 2016-04-30  7.0.1-0 Cristy  <quetzlzacatenango@image...>
   * New version 7.0.1-0, GIT revision 10716:b527bce:20160430.
 
-2016-01-30  7.0.0-0 	Fahad-Alsaidi & ShamsaHamed
+2016-01-30  7.0.0-0 Fahad-Alsaidi & ShamsaHamed
   * Add support for languages that require complex text layout (reference
     https://github.com/ImageMagick/ImageMagick/pull/88).
 
 2012-04-27  7.0.0-0 Anthony thyssen <A.Thyssen@griffith...>
   * Allow the use of set and escapes when no images in memory
diff --git a/coders/jpeg.c b/coders/jpeg.c
index 275be95cd8ab..087bf09d21be 100644
--- a/coders/jpeg.c
+++ b/coders/jpeg.c
@@ -562,19 +562,19 @@ static boolean ReadICCProfile(j_decompress_ptr jpeg_info)
     c=GetCharacter(jpeg_info);
     if (c == EOF)
       break;
     *p++=(unsigned char) c;
   }
+  error_manager->profile=NULL;
   if (i != (ssize_t) length)
     {
       profile=DestroyStringInfo(profile);
       (void) ThrowMagickException(exception,GetMagickModule(),
         CorruptImageError,"InsufficientImageDataInFile","`%s'",
         image->filename);
       return(FALSE);
     }
-  error_manager->profile=NULL;
   icc_profile=(StringInfo *) GetImageProfile(image,"icc");
   if (icc_profile != (StringInfo *) NULL)
     {
       ConcatenateStringInfo(icc_profile,profile);
       profile=DestroyStringInfo(profile);
@@ -696,11 +696,13 @@ static boolean ReadIPTCProfile(j_decompress_ptr jpeg_info)
       (void) ThrowMagickException(exception,GetMagickModule(),
         CorruptImageError,"InsufficientImageDataInFile","`%s'",
         image->filename);
       return(FALSE);
     }
-  /* The IPTC profile is actually an 8bim */
+  /*
+    The IPTC profile is actually an 8bim.
+  */
   iptc_profile=(StringInfo *) GetImageProfile(image,"8bim");
   if (iptc_profile != (StringInfo *) NULL)
     {
       ConcatenateStringInfo(iptc_profile,profile);
       profile=DestroyStringInfo(profile);

Vulnerable code:    * resolve division by zero  (reference
   * introducing MagickLevelImageColors() MagickWand method.
	  magnify:method=method, choose from these methods: eagle2X, eagle3X,
2016-01-30  7.0.0-0 	Fahad-Alsaidi & ShamsaHamed
  error_manager->profile=NULL;
  /* The IPTC profile is actually an 8bim */
Fixed code: 2019-07-18  7.0.8-55 Cristy  <quetzlzacatenango@image...>
  * Release ImageMagick version 7.0.8-55, GIT revision 15...

2019-07-18  7.0.8-55 Cristy  <quetzlzacatenango@image...>
  * Heap-buffer overflow (reference
    https://github.com/ImageMagick/ImageMagick/issues/1641

  * resolve division by zero  (reference
  * introducing MagickLevelImageColors() MagickWand method.
    magnify:method=method, choose from these methods: eagle2X, eagle3X,
2016-01-30  7.0.0-0 Fahad-Alsaidi & ShamsaHamed
  error_manager->profile=NULL;
  /*
    The IPTC profile is actually an 8bim.
  */