Project: imagemagick (imagemagick/imagemagick), language: c++
Vulnerability instance: imagemagick.cve-2020-25663
Sanitizer: address

================= Bug Report (1/3) ==================
## Source: GitHub Issue
## URL: https://github.com/ImageMagick/ImageMagick/issues/1723
## Description:
Issue: ImageMagick/ImageMagick#1723
Title: heap-use-after-free at MagickCore/pixel-accessor.h in GetPixelRed
State: closed
Created by: SuhwanSong
Created at: 2019-10-06 12:41:15+00:00
Labels: bug

Issue Body:
### Prerequisites

- [x] I have written a descriptive issue title
- [x] I have verified that I am using the latest version of ImageMagick
- [x] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There is a heap-use-after-free at MagickCore/pixel-accessor.h:378:10 in GetPixelRed
### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
[poc](https://drive.google.com/file/d/1liJ7nJK0A4M_us-LuLZjwmqKXukx3nbO/view?usp=sharing)
please run a following cmd with poc file.
`magick $PoC -despeckle -flip -monochrome -alpha Shape tmp.rla`

Here's ASAN log.
```
==8370==ERROR: AddressSanitizer: heap-use-after-free on address 0x62a000024200 at pc 0x000000796779 bp 0x7ffdf7956b10 sp 0x7ffdf7956b08
READ of size 4 at 0x62a000024200 thread T0
    #0 0x796778 in GetPixelRed ImageMagick/./MagickCore/pixel-accessor.h:378:10
    #1 0x7938d7 in GetPixelIntensity ImageMagick/MagickCore/pixel.c:2367:24
    #2 0x258de7a in SetImageAlphaChannel ImageMagick/MagickCore/channel.c:1298:28
    #3 0x625776b in CLISimpleOperatorImage ImageMagick/MagickWand/operation.c:1765:18
    #4 0x6250c70 in CLISimpleOperatorImages ImageMagick/MagickWand/operation.c:3685:12
    #5 0x632eddb in CLIOption ImageMagick/MagickWand/operation.c:5302:16
    #6 0x5588f52 in ProcessCommandOptions ImageMagick/MagickWand/magick-cli.c:477:7
    #7 0x55910cc in MagickImageCommand ImageMagick/MagickWand/magick-cli.c:796:5
    #8 0x559b0e3 in MagickCommandGenesis ImageMagick/MagickWand/mogrify.c:185:14
    #9 0x51c3e5 in MagickMain ImageMagick/utilities/magick.c:149:10
    #10 0x519c69 in main ImageMagick/utilities/magick.c:180:10
    #11 0x7fdc4a357b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #12 0x421849 in _start (magick+0x421849)

0x62a000024200 is located 0 bytes inside of 22592-byte region [0x62a000024200,0x62a000029a40)
freed by thread T0 here:
    #0 0x4e1530 in __interceptor_free.localalias.0 (magick+0x4e1530)
    #1 0x6c76f0 in RelinquishAlignedMemory ImageMagick/MagickCore/memory.c:1037:3
    #2 0x245efb2 in RelinquishPixelCachePixels ImageMagick/MagickCore/cache.c:974:40
    #3 0x24e304f in OpenPixelCache ImageMagick/MagickCore/cache.c:3762:19
    #4 0x2506bd7 in GetImagePixelCache ImageMagick/MagickCore/cache.c:1757:18
    #5 0x2533d59 in SyncImagePixelCache ImageMagick/MagickCore/cache.c:5501:28
    #6 0x2601f04 in SetImageColorspace ImageMagick/MagickCore/colorspace.c:1244:10
    #7 0x2609fa7 in TransformsRGBImage ImageMagick/MagickCore/colorspace.c:1981:11
    #8 0x2605cc8 in TransformImageColorspace ImageMagick/MagickCore/colorspace.c:1407:12
    #9 0x70c801 in ConformPixelInfo ImageMagick/MagickCore/pixel.c:232:12
    #10 0x258da15 in SetImageAlphaChannel ImageMagick/MagickCore/channel.c:1294:9
    #11 0x625776b in CLISimpleOperatorImage ImageMagick/MagickWand/operation.c:1765:18
    #12 0x6250c70 in CLISimpleOperatorImages ImageMagick/MagickWand/operation.c:3685:12
    #13 0x632eddb in CLIOption ImageMagick/MagickWand/operation.c:5302:16
    #14 0x5588f52 in ProcessCommandOptions ImageMagick/MagickWand/magick-cli.c:477:7
    #15 0x55910cc in MagickImageCommand ImageMagick/MagickWand/magick-cli.c:796:5
    #16 0x559b0e3 in MagickCommandGenesis ImageMagick/MagickWand/mogrify.c:185:14
    #17 0x51c3e5 in MagickMain ImageMagick/utilities/magick.c:149:10
    #18 0x519c69 in main ImageMagick/utilities/magick.c:180:10
    #19 0x7fdc4a357b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

previously allocated by thread T0 here:
    #0 0x4e2338 in __interceptor_posix_memalign (magick+0x4e2338)
    #1 0x6bcd6a in AcquireAlignedMemory ImageMagick/MagickCore/memory.c:265:7
    #2 0x24e0cbd in OpenPixelCache ImageMagick/MagickCore/cache.c:3733:46
    #3 0x2506bd7 in GetImagePixelCache ImageMagick/MagickCore/cache.c:1757:18
    #4 0x2533d59 in SyncImagePixelCache ImageMagick/MagickCore/cache.c:5501:28
    #5 0x56d7ad in SetImageStorageClass ImageMagick/MagickCore/image.c:2625:10
    #6 0x258d244 in SetImageAlphaChannel ImageMagick/MagickCore/channel.c:1266:14
    #7 0x625776b in CLISimpleOperatorImage ImageMagick/MagickWand/operation.c:1765:18
    #8 0x6250c70 in CLISimpleOperatorImages ImageMagick/MagickWand/operation.c:3685:12
    #9 0x632eddb in CLIOption ImageMagick/MagickWand/operation.c:5302:16
    #10 0x5588f52 in ProcessCommandOptions ImageMagick/MagickWand/magick-cli.c:477:7
    #11 0x55910cc in MagickImageCommand ImageMagick/MagickWand/magick-cli.c:796:5
    #12 0x559b0e3 in MagickCommandGenesis ImageMagick/MagickWand/mogrify.c:185:14
    #13 0x51c3e5 in MagickMain ImageMagick/utilities/magick.c:149:10
    #14 0x519c69 in main ImageMagick/utilities/magick.c:180:10
    #15 0x7fdc4a357b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-use-after-free ImageMagick/./MagickCore/pixel-accessor.h:378:10 in GetPixelRed
Shadow bytes around the buggy address:
  0x0c547fffc7f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fffc800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fffc810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fffc820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c547fffc830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c547fffc840:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffc850: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffc860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffc870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffc880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c547fffc890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==8370==ABORTING

```
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
Version: ImageMagick 7.0.8-68 Q16 x86_64 2019-10-06 https://imagemagick.org
- Environment (Operating system, version and so on):
Description: Ubuntu 18.04.1 LTS
Release: 18.04
Codename: bionic

- Additional information:
CC=clang-6 CXX=clang++6 CFLAGS="-fsanitize=address,undefined -g" CXXFLAGS="-fsanitize=address,undefined -g" ./configure --disable-openmp


<!-- Thanks for reporting the issue to ImageMagick! -->



Comments:
Comment by urban-warrior on 2019-10-06 13:54:37+00:00:
Thanks for the problem report.  We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today.  The patch will be available in the beta releases of ImageMagick @ https://www.imagemagick.org/download/beta/ by sometime tomorrow. 


---

Comment by tcullum-rh on 2020-10-28 23:35:16+00:00:
@urban-warrior Cristy, does the fix for #1724 also fix this? It looks like it could be the same bug and I notice there's not a commit attached to this one directly. I'm not intimately familiar with ImageMagick code but the similarity between the call stacks makes it seem like it could be.

Thanks!

---

Comment by urban-warrior on 2020-10-28 23:58:52+00:00:
Yes.  We attached the commit to the #1724 and you can see these are same bug its just occurs a few lines down.  The red pixel rather than the blue pixel.

---

Comment by tcullum-rh on 2020-10-29 00:07:54+00:00:
@urban-warrior Thank you for letting me know! :)

================= Bug Report (2/3) ==================
## Source: Red Hat Bugzilla
## URL: https://bugzilla.redhat.com/show_bug.cgi?id=1891601
## Description:
Bugzilla ID: 1891601
Title: CVE-2020-25663 ImageMagick: use-after-free, heap-buffer-overflow triggered by GetPixelRed, GetPixelBlue in MagickCore/pixel-accessor.h

Description
Guilherme de Almeida Suckevicz 2020-10-26 19:31:41 UTC
In ImageMagick, there is a heap-use-after-free at MagickCore/pixel-accessor.h:378:10 in GetPixelRed.

Reference:
https://github.com/ImageMagick/ImageMagick/issues/1723


Comments:
Comment 1
Todd Cullum 2020-10-28 19:20:46 UTC
Upstream patch: https://github.com/ImageMagick/ImageMagick/commit/a47e7a994766b92b10d4a87df8c1c890c8b170f3

Seems to be the same for https://github.com/ImageMagick/ImageMagick/issues/1723 which is the same issue but with GetPixelBlue.

---

Comment 2
Todd Cullum 2020-10-28 20:18:57 UTC
Flaw summary:

A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed() or GetPixelBlue()[1] was called. This could occur if an attacker is able to submit a malicious image file to be processed by ImageMagick and could lead to denial of service. It likely would not lead to anything further because the memory is used as pixel data and not e.g. a function pointer.

1. https://github.com/ImageMagick/ImageMagick/issues/1723#issuecomment-718275153

---

Comment 3
Todd Cullum 2020-10-28 21:13:31 UTC
Acknowledgments:

Name: Suhwan Song (Seoul National University)

---

Comment 4
Todd Cullum 2020-10-29 19:07:25 UTC
Statement:

This flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7. Inkscape is not affected because it no longer uses a bundled ImageMagick in Red Hat Enterprise Linux 8. For more information regarding support scopes, please see https://access.redhat.com/support/policy/updates/errata .

---

Comment 5
Todd Cullum 2020-10-29 22:19:34 UTC
*** Bug 1891988 has been marked as a duplicate of this bug. ***

================= Bug Report (3/3) ==================
## Source: GitHub Issue
## URL: https://github.com/ImageMagick/ImageMagick/issues/1723#issuecomment-718275153
## Description:
Issue: ImageMagick/ImageMagick#1723
Title: heap-use-after-free at MagickCore/pixel-accessor.h in GetPixelRed
Referenced comment by urban-warrior on 2020-10-28 23:58:52+00:00:

Yes.  We attached the commit to the #1724 and you can see these are same bug its just occurs a few lines down.  The red pixel rather than the blue pixel.

Build script:
#!/bin/bash
# Default build script template for C/C++ projects
set -eu

# Define configuration options
CONFIG_OPTS="--disable-shared"
CMAKE_OPTS="-DCMAKE_BUILD_TYPE=Debug"
MAKE_OPTS="-j$(nproc)"
BUILD_DIR="build"

# 1. Run build preparation scripts if they exist
for prep_script in buildconf autogen.sh bootstrap; do
  if [ -x "$prep_script" ]; then
    echo "Running $prep_script..."
    ./$prep_script
    break
  elif [ -f "$prep_script" ]; then
    echo "Found $prep_script but it's not executable, setting permissions..."
    chmod +x $prep_script
    ./$prep_script
    break
  fi
done

# 2. Handle different build systems
if [ -f "configure" ]; then
  echo "Found configure script, running with options: $CONFIG_OPTS"
  ./configure $CONFIG_OPTS

  echo "Building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "CMakeLists.txt" ]; then
  echo "Found CMakeLists.txt, using CMake build system"
  mkdir -p $BUILD_DIR
  cd $BUILD_DIR
  cmake $CMAKE_OPTS ..
  make $MAKE_OPTS
elif [ -f "Makefile" ] || [ -f "makefile" ]; then
  echo "Found Makefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "meson.build" ]; then
  echo "Found meson.build, using Meson build system"
  mkdir -p $BUILD_DIR
  meson setup $BUILD_DIR .
  cd $BUILD_DIR
  ninja
elif [ -f "GNUmakefile" ]; then
  echo "Found GNUmakefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -d ".git" ] && [ -f "Makefile.am" ]; then
  echo "Found Makefile.am, running autoreconf"
  autoreconf -i
  ./configure $CONFIG_OPTS
  make $MAKE_OPTS
else
  echo "WARNING: No recognized build system found!"
  echo "Trying generic approach:"
  
  # Try to detect common source patterns and compile them
  if ls *.c >/dev/null 2>&1 || ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
    echo "Found C/C++ source files, attempting direct compilation"
    if ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
      CXX=${CXX:-g++}
      echo "Compiling C++ sources with $CXX"
      $CXX -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.cpp *.cc 2>/dev/null || true
    elif ls *.c >/dev/null 2>&1; then
      CC=${CC:-gcc}
      echo "Compiling C sources with $CC"
      $CC -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.c 2>/dev/null || true
    fi
  fi
fi

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool pkg-config cmake nasm autopoint
RUN git clone https://github.com/imagemagick/imagemagick imagemagick
RUN git -C imagemagick checkout 2ac4147513fbf2ebdcad0efc707eea0cfc700401
WORKDIR $SRC/imagemagick
COPY build.sh $SRC/

Additional files: