Project: imagemagick (imagemagick/imagemagick), language: c++
Vulnerability instance: imagemagick.cve-2020-19667
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/ImageMagick/ImageMagick/issues/1895
## Description:
Issue: ImageMagick/ImageMagick#1895
Title: stack-buffer-overflow at /coders/xpm.c:232 in ReadXPMImage
State: closed
Created by: peanuts62
Created at: 2020-04-14 10:46:31+00:00

Issue Body:
### Prerequisites

- [✅ ] I have written a descriptive issue title
- [ ✅] I have verified that I am using the latest version of ImageMagick
- [ ✅] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description

There's a stack buffer overflow at /coders/xpm.c:232 in ReadXPMImage

[poc](https://raw.githubusercontent.com/minghangshen/bug_poc/master/poc2/stack-buffer-over1)

### Steps to Reproduce
run_cmd

`magick convert ./afl-Ima/sync_dir/fuzzer2/crashes/id\:000000\,sig\:06\,src\:009314\,op\:havoc\,rep\:16  t.png`

Here's ASAN log.

```
==22728==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff34696d60 at pc 0x7fb49cb4a648 bp 0x7fff34694c80 sp 0x7fff34694c70
READ of size 1 at 0x7fff34696d60 thread T0
    #0 0x7fb49cb4a647 in ParseXPMColor /home/afl-Ima/ImageMagick/coders/xpm.c:232
    #1 0x7fb49cb3d610 in ReadXPMImage /home/afl-Ima/ImageMagick/coders/xpm.c:425
    #2 0x7fb49beb03c9 in ReadImage /home/afl-Ima/ImageMagick/MagickCore/constitute.c:553
    #3 0x7fb49beb4d46 in ReadImages /home/afl-Ima/ImageMagick/MagickCore/constitute.c:941
    #4 0x7fb49b594ed2 in ConvertImageCommand /home/afl-Ima/ImageMagick/MagickWand/convert.c:606
    #5 0x7fb49b6cd098 in MagickCommandGenesis /home/afl-Ima/ImageMagick/MagickWand/mogrify.c:186
    #6 0x55be14ba8ec0 in MagickMain utilities/magick.c:149
    #7 0x55be14ba9146 in main utilities/magick.c:180
    #8 0x7fb49ae56b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #9 0x55be14ba8939 in _start (/home/ImageMagick/utilities/.libs/magick+0x1939)

Address 0x7fff34696d60 is located in stack of thread T0 at offset 8352 in frame
    #0 0x7fb49cb3adef in ReadXPMImage /home/afl-Ima/ImageMagick/coders/xpm.c:250

  This frame has 7 object(s):
    [32, 4128) 'key:251'
    [4256, 8352) 'target:251' <== Memory access at offset 8352 overflows this variable
    [8480, 8488) 'colors:286'
    [8512, 8520) 'columns:286'
    [8544, 8552) 'rows:286'
    [8576, 8584) 'width:286'
    [8608, 12704) 'symbolic:398'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/afl-Ima/ImageMagick/coders/xpm.c:232 in ParseXPMColor
Shadow bytes around the buggy address:
  0x1000668cad50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cad60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cad70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cad80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cad90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x1000668cada0: 00 00 00 00 00 00 00 00 00 00 00 00[f2]f2 f2 f2
  0x1000668cadb0: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2
  0x1000668cadc0: 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00
  0x1000668cadd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cade0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cadf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==22728==ABORTING

```
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
Version: ImageMagick 7.0.10-7 Q16 x86_64 2020-04-10 https://imagemagick.org
Copyright: © 1999-2020 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP(3.1) 
Delegates (built-in): zlib
- Environment (Operating system, version and so on):
Description: Ubuntu 18.04.1 LTS
- Additional information:
```
root@VM-0-15-ubuntu:/home# ./ImageMagick/utilities/.libs/magick identify -list policy

Path: /usr/local/etc/ImageMagick-7/policy.xml
  Policy: Resource
    name: list-length
    value: 128
  Policy: Resource
    name: file
    value: 768
  Policy: Resource
    name: disk
    value: 16EiB
  Policy: Resource
    name: map
    value: 4GiB
  Policy: Resource
    name: area
    value: 100MP
  Policy: Resource
    name: height
    value: 10KP
  Policy: Resource
    name: width
    value: 10KP

Path: [built-in]
  Policy: Undefined
    rights: None 

```

edit by peanuts 
, and Is it possible to request a cve id？
<!-- Thanks for reporting the issue to ImageMagick! -->



Comments:
Comment by urban-warrior on 2020-04-14 12:09:20+00:00:
ASAN does not return a stack issue for us.  We're using ASAN with gcc 9.3.1.  However, valgrind returned a unconditional jump.  We added a patch.

---

Comment by peanuts62 on 2020-04-14 13:37:42+00:00:
Thank you.

---

Comment by peanuts62 on 2020-04-14 15:43:54+00:00:
Can I request a CVE ID? 

---

Comment by urban-warrior on 2020-04-14 15:57:55+00:00:
Not sure what you're asking.  Anyone can request a CVE ID.  We rely on the user community to post CVE's due to our small development team and lack of time to address all issues associated with ImageMagick.

---

Comment by peanuts62 on 2020-04-14 17:34:31+00:00:
thank you , 
I hope this question can be assigned CVE

---

Comment by thesamesam on 2020-04-23 00:31:38+00:00:
@minghangshen You need to request a CVE from an authority like MITRE: https://cve.mitre.org/cve/request_id.html. Please let us know if you do.

---

Comment by peanuts62 on 2020-04-23 00:35:23+00:00:
@thesamesam I have submitted the form in https://cve.mitre.org/cve/request_id.html , and I have received an automatic response, but no response since

---

Comment by peanuts62 on 2020-04-23 00:38:05+00:00:
@thesamesam Auto-reply title ： CVE Request 878017 for CVE ID Request

---

Comment by carnil on 2020-11-21 07:46:00+00:00:
The correct CVE id seems though to be https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19667

Build script:
#!/bin/bash
# Default build script template for C/C++ projects
set -eu

# Define configuration options
CONFIG_OPTS="--disable-shared"
CMAKE_OPTS="-DCMAKE_BUILD_TYPE=Debug"
MAKE_OPTS="-j$(nproc)"
BUILD_DIR="build"

# 1. Run build preparation scripts if they exist
for prep_script in buildconf autogen.sh bootstrap; do
  if [ -x "$prep_script" ]; then
    echo "Running $prep_script..."
    ./$prep_script
    break
  elif [ -f "$prep_script" ]; then
    echo "Found $prep_script but it's not executable, setting permissions..."
    chmod +x $prep_script
    ./$prep_script
    break
  fi
done

# 2. Handle different build systems
if [ -f "configure" ]; then
  echo "Found configure script, running with options: $CONFIG_OPTS"
  ./configure $CONFIG_OPTS

  echo "Building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "CMakeLists.txt" ]; then
  echo "Found CMakeLists.txt, using CMake build system"
  mkdir -p $BUILD_DIR
  cd $BUILD_DIR
  cmake $CMAKE_OPTS ..
  make $MAKE_OPTS
elif [ -f "Makefile" ] || [ -f "makefile" ]; then
  echo "Found Makefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "meson.build" ]; then
  echo "Found meson.build, using Meson build system"
  mkdir -p $BUILD_DIR
  meson setup $BUILD_DIR .
  cd $BUILD_DIR
  ninja
elif [ -f "GNUmakefile" ]; then
  echo "Found GNUmakefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -d ".git" ] && [ -f "Makefile.am" ]; then
  echo "Found Makefile.am, running autoreconf"
  autoreconf -i
  ./configure $CONFIG_OPTS
  make $MAKE_OPTS
else
  echo "WARNING: No recognized build system found!"
  echo "Trying generic approach:"
  
  # Try to detect common source patterns and compile them
  if ls *.c >/dev/null 2>&1 || ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
    echo "Found C/C++ source files, attempting direct compilation"
    if ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
      CXX=${CXX:-g++}
      echo "Compiling C++ sources with $CXX"
      $CXX -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.cpp *.cc 2>/dev/null || true
    elif ls *.c >/dev/null 2>&1; then
      CC=${CC:-gcc}
      echo "Compiling C sources with $CC"
      $CC -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.c 2>/dev/null || true
    fi
  fi
fi

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool pkg-config cmake nasm autopoint po4a libc6:i386 libc6-dev:i386
RUN apt-get install -y make autoconf automake libtool pkg-config cmake nasm autopoint po4a libc6:i386 libc6-dev:i386
RUN git clone https://github.com/imagemagick/imagemagick imagemagick
RUN git -C imagemagick checkout 7aa934e39474da3433522dd3d55ad282142b71de
WORKDIR $SRC/imagemagick
COPY build.sh $SRC/

Additional files: