Project: imagemagick (imagemagick/imagemagick), language: c++
Vulnerability instance: imagemagick.cve-2019-19952
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/ImageMagick/ImageMagick/issues/1791
## Description:
Issue: ImageMagick/ImageMagick#1791
Title: heap-use-after-free in MngInfoDiscardObject of coders/png.c
State: closed
Created by: galycannon
Created at: 2019-11-27 06:48:11+00:00
Labels: bug

Issue Body:
### Prerequisites

- [X] I have written a descriptive issue title
- [X] I have verified that I am using the latest version of ImageMagick
- [X] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There is a heap-use-after-free vulnerability in function MngInfoDiscardObject of coders/png.c whick can be reproduced as below.

### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
[poc](https://drive.google.com/open?id=1z31pFLCb5tluwW_n_l7Dh9C_YWBs_IvX)
magick convert $poc /dev/null
`=================================================================`
`==21864==ERROR: AddressSanitizer: heap-use-after-free on address 0xf0a2c1ad at pc 0x083e0eb3 bp 0xffafc948 sp 0xffafc938`
`READ of size 1 at 0xf0a2c1ad thread T0`
`    #0 0x83e0eb2 in MngInfoDiscardObject coders/png.c:1569`
`    #1 0x83e1237 in MngInfoFreeStruct coders/png.c:1609`
`    #2 0x84021f5 in ReadMNGImage coders/png.c:7790`
`    #3 0x84fccbf in ReadImage MagickCore/constitute.c:553`
`    #4 0x810a116 in ReadStream MagickCore/stream.c:1043`
`    #5 0x84fbcd1 in PingImage MagickCore/constitute.c:273`
`    #6 0x84fc2e3 in PingImages MagickCore/constitute.c:374`
`    #7 0x8991f79 in IdentifyImageCommand MagickWand/identify.c:304`
`    #8 0x8a26ba8 in MagickCommandGenesis MagickWand/mogrify.c:185`
`    #9 0x8053b31 in MagickMain utilities/magick.c:149`
`    #10 0x8053d72 in main utilities/magick.c:180`
`    #11 0xf60c5636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636)`
`    #12 0x80535a0  (/home/ImageMagick/utilities/magick+0x80535a0)`

`0xf0a2c1ad is located 8365 bytes inside of 12368-byte region [0xf0a2a100,0xf0a2d150)`
`freed by thread T0 here:`
`    #0 0xf7241a84 in free (/usr/lib/i386-linux-gnu/libasan.so.2+0x96a84)`
`    #1 0x808a8e4 in RelinquishMagickMemory MagickCore/memory.c:1089`
`    #2 0x83e12de in MngInfoFreeStruct coders/png.c:1614`
`    #3 0x8401702 in ReadOneMNGImage coders/png.c:7681`
`    #4 0x84021e4 in ReadMNGImage coders/png.c:7789`
`    #5 0x84fccbf in ReadImage MagickCore/constitute.c:553`
`    #6 0x810a116 in ReadStream MagickCore/stream.c:1043`
`    #7 0x84fbcd1 in PingImage MagickCore/constitute.c:273`
`    #8 0x84fc2e3 in PingImages MagickCore/constitute.c:374`
`    #9 0x8991f79 in IdentifyImageCommand MagickWand/identify.c:304`
`    #10 0x8a26ba8 in MagickCommandGenesis MagickWand/mogrify.c:185`
`    #11 0x8053b31 in MagickMain utilities/magick.c:149`
`    #12 0x8053d72 in main utilities/magick.c:180`
`    #13 0xf60c5636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636)`

`previously allocated by thread T0 here:`
`    #0 0xf7241dee in malloc (/usr/lib/i386-linux-gnu/libasan.so.2+0x96dee)`
`    #1 0x80899a2 in AcquireMagickMemory MagickCore/memory.c:488`
`    #2 0x8402117 in ReadMNGImage coders/png.c:7780`
`    #3 0x84fccbf in ReadImage MagickCore/constitute.c:553`
`    #4 0x810a116 in ReadStream MagickCore/stream.c:1043`
`    #5 0x84fbcd1 in PingImage MagickCore/constitute.c:273`
`    #6 0x84fc2e3 in PingImages MagickCore/constitute.c:374`
`    #7 0x8991f79 in IdentifyImageCommand MagickWand/identify.c:304`
`    #8 0x8a26ba8 in MagickCommandGenesis MagickWand/mogrify.c:185`
`    #9 0x8053b31 in MagickMain utilities/magick.c:149`
`    #10 0x8053d72 in main utilities/magick.c:180`
`    #11 0xf60c5636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636)`

`SUMMARY: AddressSanitizer: heap-use-after-free coders/png.c:1569 MngInfoDiscardObject`
`Shadow bytes around the buggy address:`
`  0x3e1457e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd`
`  0x3e1457f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd`
`  0x3e145800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd`
`  0x3e145810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd`
`  0x3e145820: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd`
`=>0x3e145830: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd`
`  0x3e145840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd`
`  0x3e145850: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd`
`  0x3e145860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd`
`  0x3e145870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd`
`  0x3e145880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd`
`Shadow byte legend (one shadow byte represents 8 application bytes):`
`  Addressable:           00`
`  Partially addressable: 01 02 03 04 05 06 07 `
`  Heap left redzone:       fa`
`  Heap right redzone:      fb`
`  Freed heap region:       fd`
`  Stack left redzone:      f1`
`  Stack mid redzone:       f2`
`  Stack right redzone:     f3`
`  Stack partial redzone:   f4`
`  Stack after return:      f5`
`  Stack use after scope:   f8`
`  Global redzone:          f9`
`  Global init order:       f6`
`  Poisoned by user:        f7`
`  Container overflow:      fc`
`  Array cookie:            ac`
`  Intra object redzone:    bb`
`  ASan internal:           fe`
`==21864==ABORTING`
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
Version: ImageMagick 7.0.9-7 Q16 x86_64 2019-11-27 https://imagemagick.org
Copyright: ? 1999-2020 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP(4.0) 
Delegates (built-in): bzlib djvu fftw fontconfig freetype jbig jng jpeg lcms lqr lzma openexr pangocairo png tiff wmf x xml zlib

- Environment (Operating system, version and so on):
Distributor ID:	Ubuntu
Description:	Ubuntu 16.04.5 LTS
Release:	16.04
Codename:	xenial
- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->



Comments:
Comment by dlemstra on 2019-11-27 13:16:03+00:00:
Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ https://www.imagemagick.org/download/beta/ by sometime tomorrow.

---

Comment by galycannon on 2019-12-12 02:29:45+00:00:
@dlemstra Will this bug be assigned a CVE id?

---

Comment by dlemstra on 2019-12-12 21:38:08+00:00:
We're a small open-source development team. We count on our users to apply for CVE #'s so we can concentrate on development issues.

---

Comment by carnil on 2019-12-24 09:00:27+00:00:
> @dlemstra Will this bug be assigned a CVE id?

There was one assigned, looks it is CVE-2019-19952.

---

Comment by NicoleG25 on 2019-12-26 07:12:47+00:00:
Hi, It appears that MITRE is reporting 7.0.9-7 as vulnerable in their CVE : 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19952

where 7.0.9-7 is the fixed version you are reporting.
Is it a mistake from their end? 
Could you please specify what is the fixed version?
Thanks. :)



---

Comment by galycannon on 2019-12-26 09:31:56+00:00:
> 
> 
> Hi, It appears that MITRE is reporting 7.0.9-7 as vulnerable in their CVE :
> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19952
> 
> where 7.0.9-7 is the fixed version you are reporting.
> Is it a mistake from their end?
> Could you please specify what is the fixed version?
> Thanks. :)

These versions bellow all be affected
7.0.8-61
7.0.8-62
7.0.8-63
7.0.8-64
7.0.8-65
7.0.8-66
7.0.8-67
7.0.8-68
7.0.8-7
7.0.8-8
7.0.8-9
7.0.9-0
7.0.9-1
7.0.9-2
7.0.9-4
7.0.9-5
7.0.9-6
and fixed in release version 7.0.9-7

---

Comment by NicoleG25 on 2019-12-26 09:47:57+00:00:
Thank you for the quick response ! very appreciative. 
Could you also specify if this affects ImageMagick6 and if so what versions and what is the fixed version?

> > Hi, It appears that MITRE is reporting 7.0.9-7 as vulnerable in their CVE :
> > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19952
> > where 7.0.9-7 is the fixed version you are reporting.
> > Is it a mistake from their end?
> > Could you please specify what is the fixed version?
> > Thanks. :)
> 
> These versions bellow all be affected
> 7.0.8-61
> 7.0.8-62
> 7.0.8-63
> 7.0.8-64
> 7.0.8-65
> 7.0.8-66
> 7.0.8-67
> 7.0.8-68
> 7.0.8-7
> 7.0.8-8
> 7.0.8-9
> 7.0.9-0
> 7.0.9-1
> 7.0.9-2
> 7.0.9-4
> 7.0.9-5
> 7.0.9-6
> and fixed in release version 7.0.9-7



---

Comment by carnil on 2020-03-08 20:02:24+00:00:
For ImageMagick6: Is the conclusion correct that the issue has introduced in  https://github.com/ImageMagick/ImageMagick6/commit/524933c56b8b9723432cd5081e4c8e53ec80024a (6.9.10-61) for ImageMagick6, so for Imagemagick6 versions onwards 6.9.10-61 up to the fixing https://github.com/ImageMagick/ImageMagick6/commit/7ef923841437bb57bd9b55fc0bf40ddc99b93c2b (in 6.9.10-77) are affected only?

Commit References:
524933c56b8b9723432cd5081e4c8e53ec80024a
7ef923841437bb57bd9b55fc0bf40ddc99b93c2b

Build script:
#!/bin/bash
# Default build script template for C/C++ projects
set -eu

# Define configuration options
CONFIG_OPTS="--disable-shared"
CMAKE_OPTS="-DCMAKE_BUILD_TYPE=Debug"
MAKE_OPTS="-j$(nproc)"
BUILD_DIR="build"

# 1. Run build preparation scripts if they exist
for prep_script in buildconf autogen.sh bootstrap; do
  if [ -x "$prep_script" ]; then
    echo "Running $prep_script..."
    ./$prep_script
    break
  elif [ -f "$prep_script" ]; then
    echo "Found $prep_script but it's not executable, setting permissions..."
    chmod +x $prep_script
    ./$prep_script
    break
  fi
done

# 2. Handle different build systems
if [ -f "configure" ]; then
  echo "Found configure script, running with options: $CONFIG_OPTS"
  ./configure $CONFIG_OPTS

  echo "Building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "CMakeLists.txt" ]; then
  echo "Found CMakeLists.txt, using CMake build system"
  mkdir -p $BUILD_DIR
  cd $BUILD_DIR
  cmake $CMAKE_OPTS ..
  make $MAKE_OPTS
elif [ -f "Makefile" ] || [ -f "makefile" ]; then
  echo "Found Makefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "meson.build" ]; then
  echo "Found meson.build, using Meson build system"
  mkdir -p $BUILD_DIR
  meson setup $BUILD_DIR .
  cd $BUILD_DIR
  ninja
elif [ -f "GNUmakefile" ]; then
  echo "Found GNUmakefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -d ".git" ] && [ -f "Makefile.am" ]; then
  echo "Found Makefile.am, running autoreconf"
  autoreconf -i
  ./configure $CONFIG_OPTS
  make $MAKE_OPTS
else
  echo "WARNING: No recognized build system found!"
  echo "Trying generic approach:"
  
  # Try to detect common source patterns and compile them
  if ls *.c >/dev/null 2>&1 || ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
    echo "Found C/C++ source files, attempting direct compilation"
    if ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
      CXX=${CXX:-g++}
      echo "Compiling C++ sources with $CXX"
      $CXX -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.cpp *.cc 2>/dev/null || true
    elif ls *.c >/dev/null 2>&1; then
      CC=${CC:-gcc}
      echo "Compiling C sources with $CC"
      $CC -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.c 2>/dev/null || true
    fi
  fi
fi

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool pkg-config cmake nasm autopoint libc6:i386 libc6-dev:i386
RUN apt-get install -y make autoconf automake libtool pkg-config cmake nasm autopoint libc6:i386 libc6-dev:i386
RUN git clone https://github.com/imagemagick/imagemagick imagemagick
RUN git -C imagemagick checkout 971ba061458dc885bace5a1c35cfe9a837cc8ed2
WORKDIR $SRC/imagemagick
COPY build.sh $SRC/

Additional files: