Project: imagemagick (imagemagick/imagemagick), language: c++
Vulnerability instance: imagemagick.cve-2019-17541
Sanitizer: address

================= Bug Report (1/2) ==================
## Source: GitHub Issue
## URL: https://github.com/ImageMagick/ImageMagick/issues/1641
## Description:
Issue: ImageMagick/ImageMagick#1641
Title: heap-buffer-overflow at MagickCore/string.c:853 in DestroyStringInfo
State: closed
Created by: 007Alice
Created at: 2019-07-18 09:43:55+00:00

Issue Body:
### Prerequisites

- [x] I have written a descriptive issue title
- [x] I have verified that I am using the latest version of ImageMagick
- [x] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There's a heap-buffer-overflow at MagickCore/string.c:853 in DestroyStringInfo.

### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
[poc](https://github.com/007Alice/crashes/raw/master/ImageMagick_crash_0)
run command:
./magick convert poc /dev/null
```
==29840==ERROR: AddressSanitizer: heap-use-after-free on address 0x60400000af68 at pc 0x7f9e79581fab bp 0x7fff303409f0 sp 0x7fff303409e0
READ of size 8 at 0x60400000af68 thread T0
    #0 0x7f9e79581faa in DestroyStringInfo MagickCore/string.c:853
    #1 0x7f9e7985ebaf in ReadJPEGImage coders/jpeg.c:1198
    #2 0x7f9e7929dbba in ReadImage MagickCore/constitute.c:547
    #3 0x7f9e7929fde0 in ReadImages MagickCore/constitute.c:917
    #4 0x7f9e78aab965 in ConvertImageCommand MagickWand/convert.c:617
    #5 0x7f9e78c3d9a6 in MagickCommandGenesis MagickWand/mogrify.c:185
    #6 0x4017d1 in MagickMain utilities/magick.c:149
    #7 0x4019b2 in main utilities/magick.c:180
    #8 0x7f9e783c982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x4012e8 in _start (/home/ImageMagick/utilities/.libs/lt-magick+0x4012e8)

0x60400000af68 is located 24 bytes inside of 40-byte region [0x60400000af50,0x60400000af78)
freed by thread T0 here:
    #0 0x7f9e79ed42ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
    #1 0x7f9e7945cfac in RelinquishMagickMemory MagickCore/memory.c:1074
    #2 0x7f9e7958216e in DestroyStringInfo MagickCore/string.c:862
    #3 0x7f9e7985b93c in ReadICCProfile coders/jpeg.c:570
    #4 0x7f9e77373954  (/usr/lib/x86_64-linux-gnu/libjpeg.so.8+0x20954)

previously allocated by thread T0 here:
    #0 0x7f9e79ed4602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x7f9e7945c056 in AcquireMagickMemory MagickCore/memory.c:478
    #2 0x7f9e7957fb60 in AcquireCriticalMemory MagickCore/memory-private.h:64
    #3 0x7f9e7957ff57 in AcquireStringInfoContainer MagickCore/string.c:181
    #4 0x7f9e7958029d in BlobToStringInfo MagickCore/string.c:236
    #5 0x7f9e7985b7ec in ReadICCProfile coders/jpeg.c:549
    #6 0x7f9e77373954  (/usr/lib/x86_64-linux-gnu/libjpeg.so.8+0x20954)

SUMMARY: AddressSanitizer: heap-use-after-free MagickCore/string.c:853 DestroyStringInfo
Shadow bytes around the buggy address:
  0x0c087fff9590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c087fff95e0: fa fa fa fa fa fa fa fa fa fa fd fd fd[fd]fd fa
  0x0c087fff95f0: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fa
  0x0c087fff9600: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
  0x0c087fff9610: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05

SUMMARY: AddressSanitizer: heap-use-after-free MagickCore/string.c:853 DestroyStringInfo
Shadow bytes around the buggy address:
  0x0c087fff9590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c087fff95e0: fa fa fa fa fa fa fa fa fa fa fd fd fd[fd]fd fa
  0x0c087fff95f0: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fa
  0x0c087fff9600: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
  0x0c087fff9610: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
    #4 0x7f9e78aab965 in ConvertImageCommand MagickWand/convert.c:617
    #5 0x7f9e78c3d9a6 in MagickCommandGenesis MagickWand/mogrify.c:185
    #6 0x4017d1 in MagickMain utilities/magick.c:149
    #7 0x4019b2 in main utilities/magick.c:180
    #8 0x7f9e783c982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x4012e8 in _start (/home/ImageMagick/utilities/.libs/lt-magick+0x4012e8)

0x60400000af68 is located 24 bytes inside of 40-byte region [0x60400000af50,0x60400000af78)
freed by thread T0 here:
    #0 0x7f9e79ed42ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
    #1 0x7f9e7945cfac in RelinquishMagickMemory MagickCore/memory.c:1074
    #2 0x7f9e7958216e in DestroyStringInfo MagickCore/string.c:862
    #3 0x7f9e7985b93c in ReadICCProfile coders/jpeg.c:570
    #4 0x7f9e77373954  (/usr/lib/x86_64-linux-gnu/libjpeg.so.8+0x20954)

previously allocated by thread T0 here:
    #0 0x7f9e79ed4602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x7f9e7945c056 in AcquireMagickMemory MagickCore/memory.c:478
    #2 0x7f9e7957fb60 in AcquireCriticalMemory MagickCore/memory-private.h:64
    #3 0x7f9e7957ff57 in AcquireStringInfoContainer MagickCore/string.c:181
    #4 0x7f9e7958029d in BlobToStringInfo MagickCore/string.c:236
    #5 0x7f9e7985b7ec in ReadICCProfile coders/jpeg.c:549
    #6 0x7f9e77373954  (/usr/lib/x86_64-linux-gnu/libjpeg.so.8+0x20954)

SUMMARY: AddressSanitizer: heap-use-after-free MagickCore/string.c:853 DestroyStringInfo
Shadow bytes around the buggy address:
  0x0c087fff9590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c087fff95e0: fa fa fa fa fa fa fa fa fa fa fd fd fd[fd]fd fa
  0x0c087fff95f0: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fa
  0x0c087fff9600: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
  0x0c087fff9610: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
  0x0c087fff9620: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 fa
  0x0c087fff9630: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==29840==ABORTING
```
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
Version: ImageMagick 7.0.8-54 Q16 x86_64 2019-07-18 https://imagemagick.org
Copyright: © 1999-2019 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP(4.0) 
Delegates (built-in): bzlib djvu fftw fontconfig freetype gvc jbig jng jpeg lcms lqr lzma openexr pangocairo png tiff webp wmf x xml zlib

- Environment (Operating system, version and so on):
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.6 LTS
Release:        16.04
Codename:       xenial

- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->



Comments:
Comment by urban-warrior on 2019-07-18 10:22:00+00:00:
Thanks for the problem report.  We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today.  The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow. 


---

Comment by 007Alice on 2020-01-15 10:53:23+00:00:
This was assigned CVE-2019-17541.
https://www.cvedetails.com/cve/CVE-2019-17541/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17541

================= Bug Report (2/2) ==================
## Source: Chromium
## URL: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15827
## Description:
Detailed report: https://oss-fuzz.com/testcase?key=5152362538205184

Project: imagemagick
Fuzzer: libFuzzer_imagemagick_encoder_jnx_fuzzer
Fuzz target binary: encoder_jnx_fuzzer
Job Type: libfuzzer_asan_imagemagick
Platform Id: linux

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x607000004c08
Crash State:
  DestroyStringInfo
  ReadJPEGImage
  ReadImage
 
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://oss-fuzz.com/revisions?job=libfuzzer_asan_imagemagick&range=201907120249:201907130247

Reproducer Testcase: https://oss-fuzz.com/download?testcase_id=5152362538205184

Issue manually filed by: alex.gaynor

See https://github.com/google/oss-fuzz/blob/master/docs/reproducing.md for instructions to reproduce this bug locally.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without an upstream patch, then the bug report will automatically
become visible to the public.

Build script:
#!/bin/bash
# Default build script template for C/C++ projects
set -eu

# Define configuration options
CONFIG_OPTS="--disable-shared"
CMAKE_OPTS="-DCMAKE_BUILD_TYPE=Debug"
MAKE_OPTS="-j$(nproc)"
BUILD_DIR="build"

# 1. Run build preparation scripts if they exist
for prep_script in buildconf autogen.sh bootstrap; do
  if [ -x "$prep_script" ]; then
    echo "Running $prep_script..."
    ./$prep_script
    break
  elif [ -f "$prep_script" ]; then
    echo "Found $prep_script but it's not executable, setting permissions..."
    chmod +x $prep_script
    ./$prep_script
    break
  fi
done

# 2. Handle different build systems
if [ -f "configure" ]; then
  echo "Found configure script, running with options: $CONFIG_OPTS"
  ./configure $CONFIG_OPTS

  echo "Building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "CMakeLists.txt" ]; then
  echo "Found CMakeLists.txt, using CMake build system"
  mkdir -p $BUILD_DIR
  cd $BUILD_DIR
  cmake $CMAKE_OPTS ..
  make $MAKE_OPTS
elif [ -f "Makefile" ] || [ -f "makefile" ]; then
  echo "Found Makefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "meson.build" ]; then
  echo "Found meson.build, using Meson build system"
  mkdir -p $BUILD_DIR
  meson setup $BUILD_DIR .
  cd $BUILD_DIR
  ninja
elif [ -f "GNUmakefile" ]; then
  echo "Found GNUmakefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -d ".git" ] && [ -f "Makefile.am" ]; then
  echo "Found Makefile.am, running autoreconf"
  autoreconf -i
  ./configure $CONFIG_OPTS
  make $MAKE_OPTS
else
  echo "WARNING: No recognized build system found!"
  echo "Trying generic approach:"
  
  # Try to detect common source patterns and compile them
  if ls *.c >/dev/null 2>&1 || ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
    echo "Found C/C++ source files, attempting direct compilation"
    if ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
      CXX=${CXX:-g++}
      echo "Compiling C++ sources with $CXX"
      $CXX -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.cpp *.cc 2>/dev/null || true
    elif ls *.c >/dev/null 2>&1; then
      CC=${CC:-gcc}
      echo "Compiling C sources with $CC"
      $CC -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.c 2>/dev/null || true
    fi
  fi
fi

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool pkg-config cmake nasm autopoint
RUN git clone https://github.com/imagemagick/imagemagick imagemagick
RUN git -C imagemagick checkout 8de7d660fcffcbc580cec1daa09bc7d4ededdf6b
WORKDIR $SRC/imagemagick
COPY build.sh $SRC/

Additional files: