Project: imagemagick (imagemagick/imagemagick), language: c++
Vulnerability instance: imagemagick.cve-2021-3962
Sanitizer: address

================= Bug Report (1/2) ==================
## Source: Red Hat Bugzilla
## URL: https://bugzilla.redhat.com/show_bug.cgi?id=2023196
## Description:
Bugzilla ID: 2023196
Title: CVE-2021-3962 ImageMagick: heap-use-after-free in at dcm.c RelinquishDCMMemory

Description
Sandipan Roy 2021-11-15 07:55:34 UTC
ImageMagick: heap-use-after-free in at dcm.c RelinquishDCMMemory

https://github.com/ImageMagick/ImageMagick/issues/4446


Comments:
Comment 1
Sandipan Roy 2021-11-15 08:37:35 UTC
Created ImageMagick tracking bugs for this issue:

Affects: fedora-all [bug 2023211]

---

Comment 4
Sandipan Roy 2021-11-15 16:13:35 UTC
Created ImageMagick tracking bugs for this issue:

Affects: epel-8 [bug 2023411]

---

Comment 8
msiddiqu 2021-11-23 04:24:27 UTC
References: 
 
https://github.com/ImageMagick/ImageMagick/commit/82775af03bbb10a0a1d0e15c0156c75673b4525e
https://github.com/ImageMagick/ImageMagick/issues/4446

---

Comment 9
Sergio Basto 2021-11-23 12:05:53 UTC
ImageMagick6 don't have that codification only ImageMagick7

https://github.com/ImageMagick/ImageMagick6/blob/main/coders/dcm.c#L3978

---

Comment 10
msiddiqu 2021-11-24 04:17:35 UTC
In reply to comment #9:
> ImageMagick6 don't have that codification only ImageMagick7
> 
> https://github.com/ImageMagick/ImageMagick6/blob/main/coders/dcm.c#L3978

It does look like that.

The issue was fixed in 7.1.0-16 7.1.0-15 7.1.0-14
imagemagick-6 seem to be notaffected.

================= Bug Report (2/2) ==================
## Source: GitHub Issue
## URL: https://github.com/ImageMagick/ImageMagick/issues/4446
## Description:
Issue: ImageMagick/ImageMagick#4446
Title: heap-use-after-free in magick at dcm.c RelinquishDCMMemory
State: closed
Created by: fa1lr4in
Created at: 2021-11-06 05:20:44+00:00

Issue Body:
### ImageMagick version

7.1.0-14

### Operating system

Linux

### Operating system, version and so on

OS: Ubuntu 18.04.6 LTS Version: ImageMagick 7.1.0-14 Q16-HDRI x86_64 2021-10-28 https://imagemagick.org Copyright: (C) 1999-2021 ImageMagick Studio  Delegates (built-in): fontconfig freetype jng jpeg lzma pangocairo png x xml zlib Compiler: gcc (4.2)

### Description

Hello,
We are currently working on fuzz testing feature, and we found a **heap-use-after-free** on **magick**.


### Steps to Reproduce

build it
`./configure --disable-shared && make && make install
`
run it
`
./magick convert -adjoin -alpha copy -antialias -append -auto-gamma -auto-level  -auto-orient poc  /dev/null
`
output
### free(): double free detected in tcache 2



When I compile in ASAN mode
`
./magick convert -adjoin -alpha copy -antialias -append -auto-gamma -auto-level  -auto-orient poc  /dev/null
`


=================================================================
==11927==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f000000580 at pc 0x000000f0f98c bp 0x7ffe3d8a7fd0 sp 0x7ffe3d8a7fc8
READ of size 8 at 0x60f000000580 thread T0
    #0 0xf0f98b in RelinquishDCMMemory /root/fuzz/target/imagemagick/ImageMagick/coders/dcm.c:3039:20
    #1 0xf08eb8 in ReadDCMImage /root/fuzz/target/imagemagick/ImageMagick/coders/dcm.c:4002:11
    #2 0x65b638 in ReadImage /root/fuzz/target/imagemagick/ImageMagick/MagickCore/constitute.c:563:15
    #3 0x6602d3 in ReadImages /root/fuzz/target/imagemagick/ImageMagick/MagickCore/constitute.c:955:9
    #4 0x15bd745 in ConvertImageCommand /root/fuzz/target/imagemagick/ImageMagick/MagickWand/convert.c:611:18
    #5 0x177d150 in MagickCommandGenesis /root/fuzz/target/imagemagick/ImageMagick/MagickWand/mogrify.c:188:14
    #6 0x5f9924 in MagickMain /root/fuzz/target/imagemagick/ImageMagick/utilities/magick.c:150:10
    #7 0x5f9924 in main /root/fuzz/target/imagemagick/ImageMagick/utilities/magick.c:182:10
    #8 0x7f35dfd66bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
    #9 0x549e99 in _start (/root/fuzz/target/imagemagick/ImageMagick/install/bin/magick+0x549e99)

0x60f000000580 is located 144 bytes inside of 168-byte region [0x60f0000004f0,0x60f000000598)
freed by thread T0 here:
    #0 0x5c4af2 in free (/root/fuzz/target/imagemagick/ImageMagick/install/bin/magick+0x5c4af2)
    #1 0xf0f82c in RelinquishMagickMemory /root/fuzz/target/imagemagick/ImageMagick/MagickCore/memory.c:1167:3
    #2 0xf0f82c in RelinquishDCMMemory /root/fuzz/target/imagemagick/ImageMagick/coders/dcm.c:3043:35
    #3 0xf08e0b in ReadDCMImage /root/fuzz/target/imagemagick/ImageMagick/coders/dcm.c:3999:9
    #4 0x65b638 in ReadImage /root/fuzz/target/imagemagick/ImageMagick/MagickCore/constitute.c:563:15
    #5 0x6602d3 in ReadImages /root/fuzz/target/imagemagick/ImageMagick/MagickCore/constitute.c:955:9
    #6 0x15bd745 in ConvertImageCommand /root/fuzz/target/imagemagick/ImageMagick/MagickWand/convert.c:611:18
    #7 0x177d150 in MagickCommandGenesis /root/fuzz/target/imagemagick/ImageMagick/MagickWand/mogrify.c:188:14
    #8 0x5f9924 in MagickMain /root/fuzz/target/imagemagick/ImageMagick/utilities/magick.c:150:10
    #9 0x5f9924 in main /root/fuzz/target/imagemagick/ImageMagick/utilities/magick.c:182:10
    #10 0x7f35dfd66bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310

previously allocated by thread T0 here:
    #0 0x5c4d5d in malloc (/root/fuzz/target/imagemagick/ImageMagick/install/bin/magick+0x5c4d5d)
    #1 0xefb803 in AcquireMagickMemory /root/fuzz/target/imagemagick/ImageMagick/MagickCore/memory.c:558:10
    #2 0xefb803 in ReadDCMImage /root/fuzz/target/imagemagick/ImageMagick/coders/dcm.c:3142:33
    #3 0x65b638 in ReadImage /root/fuzz/target/imagemagick/ImageMagick/MagickCore/constitute.c:563:15
    #4 0x6602d3 in ReadImages /root/fuzz/target/imagemagick/ImageMagick/MagickCore/constitute.c:955:9
    #5 0x15bd745 in ConvertImageCommand /root/fuzz/target/imagemagick/ImageMagick/MagickWand/convert.c:611:18
    #6 0x177d150 in MagickCommandGenesis /root/fuzz/target/imagemagick/ImageMagick/MagickWand/mogrify.c:188:14
    #7 0x5f9924 in MagickMain /root/fuzz/target/imagemagick/ImageMagick/utilities/magick.c:150:10
    #8 0x5f9924 in main /root/fuzz/target/imagemagick/ImageMagick/utilities/magick.c:182:10
    #9 0x7f35dfd66bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-use-after-free /root/fuzz/target/imagemagick/ImageMagick/coders/dcm.c:3039:20 in RelinquishDCMMemory
Shadow bytes around the buggy address:
  0x0c1e7fff8060: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1e7fff8070: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
  0x0c1e7fff8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1e7fff8090: 00 00 00 00 00 fa fa fa fa fa fa fa fa fa fd fd
  0x0c1e7fff80a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c1e7fff80b0:[fd]fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e7fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e7fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e7fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e7fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e7fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==11927==ABORTING


### Images

[poc.zip](https://github.com/ImageMagick/ImageMagick/files/7489944/poc.zip)



Comments:
Comment by dlemstra on 2021-11-06 08:25:32+00:00:
Thanks for reporting this. This will be resolved in the next release of ImageMagick.

---

Comment by bhaskarvilles on 2021-11-11 06:17:19+00:00:
how can i compile this in ASAN mode ?

---

Comment by fa1lr4in on 2021-11-11 06:42:41+00:00:
> how can i compile this in ASAN mode ?

You can use the "-fsanitize=address" option to enable it

---

Comment by ByteHackr on 2021-11-22 07:36:24+00:00:
@fa1lr4in 

CVE Assigned: `CVE-2021-3962`
https://bugzilla.redhat.com/show_bug.cgi?id=2023196

---

Comment by fa1lr4in on 2021-11-23 07:52:10+00:00:
> @fa1lr4in
> 
> CVE 分配：[https](https://bugzilla.redhat.com/show_bug.cgi?id=2023196) ://bugzilla.redhat.com/show_bug.cgi?id `CVE-2021-3962` [=2023196](https://bugzilla.redhat.com/show_bug.cgi?id=2023196)

Thank you for your notification!

Attachments:
https://github.com/ImageMagick/ImageMagick/files/7489944/poc.zip

Build script:
#!/bin/bash
# Default build script template for C/C++ projects
set -eu

# Define configuration options
CONFIG_OPTS="--disable-shared"
CMAKE_OPTS="-DCMAKE_BUILD_TYPE=Debug"
MAKE_OPTS="-j$(nproc)"
BUILD_DIR="build"

# 1. Run build preparation scripts if they exist
for prep_script in buildconf autogen.sh bootstrap; do
  if [ -x "$prep_script" ]; then
    echo "Running $prep_script..."
    ./$prep_script
    break
  elif [ -f "$prep_script" ]; then
    echo "Found $prep_script but it's not executable, setting permissions..."
    chmod +x $prep_script
    ./$prep_script
    break
  fi
done

# 2. Handle different build systems
if [ -f "configure" ]; then
  echo "Found configure script, running with options: $CONFIG_OPTS"
  ./configure $CONFIG_OPTS

  echo "Building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "CMakeLists.txt" ]; then
  echo "Found CMakeLists.txt, using CMake build system"
  mkdir -p $BUILD_DIR
  cd $BUILD_DIR
  cmake $CMAKE_OPTS ..
  make $MAKE_OPTS
elif [ -f "Makefile" ] || [ -f "makefile" ]; then
  echo "Found Makefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "meson.build" ]; then
  echo "Found meson.build, using Meson build system"
  mkdir -p $BUILD_DIR
  meson setup $BUILD_DIR .
  cd $BUILD_DIR
  ninja
elif [ -f "GNUmakefile" ]; then
  echo "Found GNUmakefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -d ".git" ] && [ -f "Makefile.am" ]; then
  echo "Found Makefile.am, running autoreconf"
  autoreconf -i
  ./configure $CONFIG_OPTS
  make $MAKE_OPTS
else
  echo "WARNING: No recognized build system found!"
  echo "Trying generic approach:"
  
  # Try to detect common source patterns and compile them
  if ls *.c >/dev/null 2>&1 || ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
    echo "Found C/C++ source files, attempting direct compilation"
    if ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
      CXX=${CXX:-g++}
      echo "Compiling C++ sources with $CXX"
      $CXX -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.cpp *.cc 2>/dev/null || true
    elif ls *.c >/dev/null 2>&1; then
      CC=${CC:-gcc}
      echo "Compiling C sources with $CC"
      $CC -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.c 2>/dev/null || true
    fi
  fi
fi

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake groff libtool pkg-config cmake nasm autopoint po4a libc6:i386 libc6-dev:i386
RUN apt-get install -y make autoconf automake groff libtool pkg-config cmake nasm autopoint po4a libc6:i386 libc6-dev:i386
RUN git clone https://github.com/imagemagick/imagemagick imagemagick
RUN git -C imagemagick checkout 7fef3c3ac8ef5397f8a7f318a5316f09a2c999c7
WORKDIR $SRC/imagemagick
COPY build.sh $SRC/

Additional files: