Project: imagemagick (imagemagick/imagemagick), language: c++
Vulnerability instance: imagemagick.cve-2019-13299
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/ImageMagick/ImageMagick/issues/1610
## Description:
Issue: ImageMagick/ImageMagick#1610
Title: heap-buffer-overflow at MagickCore/pixel-accessor.h:116:10 in GetPixelChannel
State: closed
Created by: SuhwanSong
Created at: 2019-06-21 06:05:24+00:00
Labels: bug

Issue Body:
### Prerequisites

- [x] I have written a descriptive issue title
- [x] I have verified that I am using the latest version of ImageMagick
- [x] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There's a heap-buffer-overflow at MagickCore/pixel-accessor.h:116:10 in GetPixelChannel.

### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
run_cmd:
`magick -seed 0 "(" magick:netscape -monochrome  ")" "(" magick:netscape +repage ")" -geometry 433%-80-57 -adjoin -evaluate-sequence Median   tmp`

Here's ASAN log.
```
==30168==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7febb7ba1400 at pc 0x7febc5808632 bp 0x7ffd269baff0 sp 0x7ffd269bafe8
READ of size 4 at 0x7febb7ba1400 thread T0
    #0 0x7febc5808631 in GetPixelChannel ./MagickCore/pixel-accessor.h:116:10
    #1 0x7febc5805ff6 in EvaluateImages MagickCore/statistic.c:587:33
    #2 0x7febc4e1a5bf in CLIListOperatorImages MagickWand/operation.c:4084:22
    #3 0x7febc4e2435e in CLIOption MagickWand/operation.c:5279:14
    #4 0x7febc4c65a99 in ProcessCommandOptions MagickWand/magick-cli.c:477:7
    #5 0x7febc4c66d0a in MagickImageCommand MagickWand/magick-cli.c:796:5
    #6 0x7febc4cb0ba1 in MagickCommandGenesis MagickWand/mogrify.c:185:14
    #7 0x526f95 in MagickMain utilities/magick.c:149:10
    #8 0x5268e1 in main utilities/magick.c:180:10
    #9 0x7febbf727b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #10 0x41b069 in _start (install/bin/magick+0x41b069)

0x7febb7ba1400 is located 0 bytes to the right of 248832-byte region [0x7febb7b64800,0x7febb7ba1400)
allocated by thread T0 here:
    #0 0x4e6200 in __interceptor_posix_memalign (install/bin/magick+0x4e6200)
    #1 0x7febc569fed6 in AcquireAlignedMemory MagickCore/memory.c:265:7
    #2 0x7febc53e861c in OpenPixelCache MagickCore/cache.c:3728:46
    #3 0x7febc53ee901 in GetImagePixelCache MagickCore/cache.c:1754:18
    #4 0x7febc53f4bc9 in SyncImagePixelCache MagickCore/cache.c:5488:28
    #5 0x7febc5653831 in SetImageStorageClass MagickCore/image.c:2627:10
    #6 0x7febc54187e2 in AcquireImageColormap MagickCore/colormap.c:144:10
    #7 0x7febc575d137 in AssignImageColors MagickCore/quantize.c:514:7
    #8 0x7febc5753f38 in QuantizeImage MagickCore/quantize.c:2724:14
    #9 0x7febc53ae56c in SetImageType MagickCore/attribute.c:1495:14
    #10 0x7febc4e0cace in CLISimpleOperatorImage MagickWand/operation.c:2792:18
    #11 0x7febc4dfec78 in CLISimpleOperatorImages MagickWand/operation.c:3685:12
    #12 0x7febc4e24315 in CLIOption MagickWand/operation.c:5273:16
    #13 0x7febc4c65a99 in ProcessCommandOptions MagickWand/magick-cli.c:477:7
    #14 0x7febc4c66d0a in MagickImageCommand MagickWand/magick-cli.c:796:5
    #15 0x7febc4cb0ba1 in MagickCommandGenesis MagickWand/mogrify.c:185:14
    #16 0x526f95 in MagickMain utilities/magick.c:149:10
    #17 0x5268e1 in main utilities/magick.c:180:10
    #18 0x7febbf727b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

SUMMARY: AddressSanitizer: heap-buffer-overflow ./MagickCore/pixel-accessor.h:116:10 in GetPixelChannel
```

### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
Version: ImageMagick 7.0.8-50 Q16 x86_64 2019-06-21 https://imagemagick.org

- Environment (Operating system, version and so on):
Description:	Ubuntu 18.04.1 LTS
Release:	18.04
Codename: bionic

- Additional information:
CC=clang-7 CXX=clang++-7 ./configure --disable-openmp

<!-- Thanks for reporting the issue to ImageMagick! -->



Comments:
Comment by urban-warrior on 2019-06-22 00:43:37+00:00:
Thanks for the problem report.  We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today.  The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.

---

Comment by nohmask on 2019-07-08 01:49:37+00:00:
This was assigned CVE-2019-13299.

---

Comment by Kirill200889 on 2019-10-25 12:41:08+00:00:
Hi, I noticed that the fixing commit isn't included in the releases, only in master. All versions are still valnurable if I download the files from GitHub?

---

Comment by urban-warrior on 2019-10-25 12:54:42+00:00:
The patch is in the current release.  Download the latest release, run your POC, if it fails, let us know.

---

Comment by Kirill200889 on 2019-10-25 13:33:44+00:00:
I can't uderstand something
This issue fixed by 8187d2d8fd010d2d6b1a3a8edd935beec404dddc
and 1611 issue fixed by d4fc44b58a14f76b1ac997517d742ee12c9dc5d3
These two commits together cancel each other at "MagickCore/pixel-accessor.h"
so it means this issue 1610 never fixed?

---

Comment by urban-warrior on 2019-10-25 13:50:32+00:00:
The POC is no longer triggered suggesting our patch mitigated the vulnerability and the issue is fixed.  Can you still reproduce the problem in the latest releases of ImageMagick?

Commit References:
d4fc44b58a14f76b1ac997517d742ee12c9dc5d3
8187d2d8fd010d2d6b1a3a8edd935beec404dddc

Build script:
#!/bin/bash
# Default build script template for C/C++ projects
set -eu

# Define configuration options
CONFIG_OPTS="--disable-shared"
CMAKE_OPTS="-DCMAKE_BUILD_TYPE=Debug"
MAKE_OPTS="-j$(nproc)"
BUILD_DIR="build"

# 1. Run build preparation scripts if they exist
for prep_script in buildconf autogen.sh bootstrap; do
  if [ -x "$prep_script" ]; then
    echo "Running $prep_script..."
    ./$prep_script
    break
  elif [ -f "$prep_script" ]; then
    echo "Found $prep_script but it's not executable, setting permissions..."
    chmod +x $prep_script
    ./$prep_script
    break
  fi
done

# 2. Handle different build systems
if [ -f "configure" ]; then
  echo "Found configure script, running with options: $CONFIG_OPTS"
  ./configure $CONFIG_OPTS

  echo "Building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "CMakeLists.txt" ]; then
  echo "Found CMakeLists.txt, using CMake build system"
  mkdir -p $BUILD_DIR
  cd $BUILD_DIR
  cmake $CMAKE_OPTS ..
  make $MAKE_OPTS
elif [ -f "Makefile" ] || [ -f "makefile" ]; then
  echo "Found Makefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "meson.build" ]; then
  echo "Found meson.build, using Meson build system"
  mkdir -p $BUILD_DIR
  meson setup $BUILD_DIR .
  cd $BUILD_DIR
  ninja
elif [ -f "GNUmakefile" ]; then
  echo "Found GNUmakefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -d ".git" ] && [ -f "Makefile.am" ]; then
  echo "Found Makefile.am, running autoreconf"
  autoreconf -i
  ./configure $CONFIG_OPTS
  make $MAKE_OPTS
else
  echo "WARNING: No recognized build system found!"
  echo "Trying generic approach:"
  
  # Try to detect common source patterns and compile them
  if ls *.c >/dev/null 2>&1 || ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
    echo "Found C/C++ source files, attempting direct compilation"
    if ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
      CXX=${CXX:-g++}
      echo "Compiling C++ sources with $CXX"
      $CXX -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.cpp *.cc 2>/dev/null || true
    elif ls *.c >/dev/null 2>&1; then
      CC=${CC:-gcc}
      echo "Compiling C sources with $CC"
      $CC -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.c 2>/dev/null || true
    fi
  fi
fi

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool pkg-config cmake nasm autopoint
RUN git clone https://github.com/imagemagick/imagemagick imagemagick
RUN git -C imagemagick checkout 604588fc35c7585abb7a9e71f69bb82e4389fefc
WORKDIR $SRC/imagemagick
COPY build.sh $SRC/

Additional files: