Project: imagemagick (imagemagick/imagemagick), language: c++
Vulnerability instance: imagemagick.cve-2019-13301
Sanitizer: address

================= Bug Report (1/2) ==================
## Source: GitHub Issue
## URL: https://github.com/ImageMagick/ImageMagick/issues/1585
## Description:
Issue: ImageMagick/ImageMagick#1585
Title: memory leaks in AcquireMagickMemory of MagickCore/memory.c
State: closed
Created by: SuhwanSong
Created at: 2019-06-10 14:34:22+00:00
Labels: bug

Issue Body:
### Prerequisites

- [x] I have written a descriptive issue title
- [x] I have verified that I am using the latest version of ImageMagick
- [x] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
There is a heap buffer overflow/heap-use-after-free vulnerability in MagickCore/resize.c:2823:28 in .omp_outlined._debug__.72  with the same input.

And also memory leaks in AcquireMagickMemory of MagickCore/memory.c:478:10 
this still exists [#1558](https://github.com/ImageMagick/ImageMagick/issues/1558)

It sometimes doesn't occur so needs to be executed for several times. 

I found that this bug was not reproduced but it is reproduced with certain arguments. [#1500](https://github.com/ImageMagick/ImageMagick/issues/1500)
<!-- A description of the bug or feature -->

### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
run cmd: 
`magick "-black-point-compensation" "-weight" "63" "(" "magick:logo" "-normalize" "-resize" "892%-38-49" ")" "(" "magick:wizard" "-preview" "Spiff" "-solarize" "35%" "-cycle" "813" ")" "(" "magick:granite" "-preview" "Blur" "-draw" ""rotate" "205"" "-colors" "109"  ")" "-crop" "333x497" "-print" ""
`

This is about the heap-buffer-overflow.

```
=================================================================
==19621==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fc8b5310d28 at pc 0x000000f00dff bp 0x7ffc7c6a9a50 sp 0x7ffc7c6a9a48
READ of size 4 at 0x7fc8b5310d28 thread T0
    #0 0xf00dfe in .omp_outlined._debug__.72 MagickCore/resize.c:2823:28
    #1 0xf019b6 in .omp_outlined..73 MagickCore/resize.c:2706:3
    #2 0x7fc8c2077452 in __kmp_invoke_microtask (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x7c452)
    #3 0x7fc8c20311b6  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x361b6)
    #4 0x7fc8c20322b5 in __kmp_fork_call (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x372b5)
    #5 0x7fc8c20257be in __kmpc_fork_call (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x2a7be)
    #6 0xef317f in VerticalFilter MagickCore/resize.c:2703:11
    #7 0xef0442 in ResizeImage MagickCore/resize.c:2961:14
    #8 0xefb6bd in ThumbnailImage MagickCore/resize.c:3703:21
    #9 0xd0cdfd in PreviewImage MagickCore/effect.c:2337:15
    #10 0x13f0c33 in CLISimpleOperatorImage MagickWand/operation.c:2964:21
    #11 0x13e0af5 in CLISimpleOperatorImages MagickWand/operation.c:3685:12
    #12 0x1406e7c in CLIOption MagickWand/operation.c:5270:16
    #13 0x128a9db in ProcessCommandOptions MagickWand/magick-cli.c:477:7
    #14 0x128bcf2 in MagickImageCommand MagickWand/magick-cli.c:796:5
    #15 0x128e457 in MagickCommandGenesis MagickWand/mogrify.c:185:14
    #16 0x531745 in MagickMain utilities/magick.c:149:10
    #17 0x531091 in main utilities/magick.c:180:10
    #18 0x7fc8c1a13b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #19 0x425819 in _start (/usr/local/bin/magick+0x425819)

0x7fc8b5310d28 is located 1832 bytes to the right of 1175040-byte region [0x7fc8b51f1800,0x7fc8b5310600)
allocated by thread T0 here:
    #0 0x4f09b0 in __interceptor_posix_memalign (/usr/local/bin/magick+0x4f09b0)
    #1 0x5822fa in AcquireAlignedMemory MagickCore/memory.c:265:7
    #2 0xb11bac in OpenPixelCache MagickCore/cache.c:3728:46
    #3 0xb188c5 in GetImagePixelCache MagickCore/cache.c:1754:18
    #4 0xb1f66b in SyncImagePixelCache MagickCore/cache.c:5494:28
    #5 0x53f46e in SetImageStorageClass MagickCore/image.c:2627:10
    #6 0xef2791 in VerticalFilter MagickCore/resize.c:2681:7
    #7 0xef0442 in ResizeImage MagickCore/resize.c:2961:14
    #8 0xefb6bd in ThumbnailImage MagickCore/resize.c:3703:21
    #9 0xd0cdfd in PreviewImage MagickCore/effect.c:2337:15
    #10 0x13f0c33 in CLISimpleOperatorImage MagickWand/operation.c:2964:21
    #11 0x13e0af5 in CLISimpleOperatorImages MagickWand/operation.c:3685:12
    #12 0x1406e7c in CLIOption MagickWand/operation.c:5270:16
    #13 0x128a9db in ProcessCommandOptions MagickWand/magick-cli.c:477:7
    #14 0x128bcf2 in MagickImageCommand MagickWand/magick-cli.c:796:5
    #15 0x128e457 in MagickCommandGenesis MagickWand/mogrify.c:185:14
    #16 0x531745 in MagickMain utilities/magick.c:149:10
    #17 0x531091 in main utilities/magick.c:180:10
    #18 0x7fc8c1a13b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

SUMMARY: AddressSanitizer: heap-buffer-overflow MagickCore/resize.c:2823:28 in .omp_outlined._debug__.72
```
And this is about heap-use-after-free.
```
=================================================================
==24235==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f2fd1712c88 at pc 0x000000f00dff bp 0x7ffef1b2acd0 sp 0x7ffef1b2acc8
READ of size 4 at 0x7f2fd1712c88 thread T0
    #0 0xf00dfe in .omp_outlined._debug__.72 MagickCore/resize.c:2823:28
    #1 0xf019b6 in .omp_outlined..73 MagickCore/resize.c:2706:3
    #2 0x7f2fde527452 in __kmp_invoke_microtask (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x7c452)
    #3 0x7f2fde4e11b6  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x361b6)
    #4 0x7f2fde4e22b5 in __kmp_fork_call (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x372b5)
    #5 0x7f2fde4d57be in __kmpc_fork_call (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x2a7be)
    #6 0xef317f in VerticalFilter MagickCore/resize.c:2703:11
    #7 0xef0442 in ResizeImage MagickCore/resize.c:2961:14
    #8 0xefb6bd in ThumbnailImage MagickCore/resize.c:3703:21
    #9 0xd0cdfd in PreviewImage MagickCore/effect.c:2337:15
    #10 0x13f0c33 in CLISimpleOperatorImage MagickWand/operation.c:2964:21
    #11 0x13e0af5 in CLISimpleOperatorImages MagickWand/operation.c:3685:12
    #12 0x1406e7c in CLIOption MagickWand/operation.c:5270:16
    #13 0x128a9db in ProcessCommandOptions MagickWand/magick-cli.c:477:7
    #14 0x128bcf2 in MagickImageCommand MagickWand/magick-cli.c:796:5
    #15 0x128e457 in MagickCommandGenesis MagickWand/mogrify.c:185:14
    #16 0x531745 in MagickMain utilities/magick.c:149:10
    #17 0x531091 in main utilities/magick.c:180:10
    #18 0x7f2fddec3b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #19 0x425819 in _start (/usr/local/bin/magick+0x425819)

0x7f2fd1712c88 is located 1160 bytes inside of 1566720-byte region [0x7f2fd1712800,0x7f2fd1891000)
freed by thread T0 here:
    #0 0x4ef768 in __interceptor_free (/usr/local/bin/magick+0x4ef768)
    #1 0x583e5c in RelinquishAlignedMemory MagickCore/memory.c:1037:3
    #2 0xafde01 in RelinquishPixelCachePixels MagickCore/cache.c:972:40
    #3 0xb12119 in OpenPixelCache MagickCore/cache.c:3757:19
    #4 0xb188c5 in GetImagePixelCache MagickCore/cache.c:1754:18
    #5 0xb1f66b in SyncImagePixelCache MagickCore/cache.c:5494:28
    #6 0x53f46e in SetImageStorageClass MagickCore/image.c:2627:10
    #7 0xef2791 in VerticalFilter MagickCore/resize.c:2681:7
    #8 0xef0442 in ResizeImage MagickCore/resize.c:2961:14
    #9 0xefb6bd in ThumbnailImage MagickCore/resize.c:3703:21
    #10 0xd0cdfd in PreviewImage MagickCore/effect.c:2337:15
    #11 0x13f0c33 in CLISimpleOperatorImage MagickWand/operation.c:2964:21
    #12 0x13e0af5 in CLISimpleOperatorImages MagickWand/operation.c:3685:12
    #13 0x1406e7c in CLIOption MagickWand/operation.c:5270:16
    #14 0x128a9db in ProcessCommandOptions MagickWand/magick-cli.c:477:7
    #15 0x128bcf2 in MagickImageCommand MagickWand/magick-cli.c:796:5
    #16 0x128e457 in MagickCommandGenesis MagickWand/mogrify.c:185:14
    #17 0x531745 in MagickMain utilities/magick.c:149:10
    #18 0x531091 in main utilities/magick.c:180:10
    #19 0x7f2fddec3b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

previously allocated by thread T0 here:
    #0 0x4f09b0 in __interceptor_posix_memalign (/usr/local/bin/magick+0x4f09b0)
    #1 0x5822fa in AcquireAlignedMemory MagickCore/memory.c:265:7
    #2 0xb11bac in OpenPixelCache MagickCore/cache.c:3728:46
    #3 0xb188c5 in GetImagePixelCache MagickCore/cache.c:1754:18
    #4 0xb1f66b in SyncImagePixelCache MagickCore/cache.c:5494:28
    #5 0x54833f in SetImageExtent MagickCore/image.c:2668:10
    #6 0x53f1c3 in CloneImage MagickCore/image.c:911:7
    #7 0xef0272 in ResizeImage MagickCore/resize.c:2940:18
    #8 0xefb6bd in ThumbnailImage MagickCore/resize.c:3703:21
    #9 0xd0cdfd in PreviewImage MagickCore/effect.c:2337:15
    #10 0x13f0c33 in CLISimpleOperatorImage MagickWand/operation.c:2964:21
    #11 0x13e0af5 in CLISimpleOperatorImages MagickWand/operation.c:3685:12
    #12 0x1406e7c in CLIOption MagickWand/operation.c:5270:16
    #13 0x128a9db in ProcessCommandOptions MagickWand/magick-cli.c:477:7
    #14 0x128bcf2 in MagickImageCommand MagickWand/magick-cli.c:796:5
    #15 0x128e457 in MagickCommandGenesis MagickWand/mogrify.c:185:14
    #16 0x531745 in MagickMain utilities/magick.c:149:10
    #17 0x531091 in main utilities/magick.c:180:10
    #18 0x7f2fddec3b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

SUMMARY: AddressSanitizer: heap-use-after-free MagickCore/resize.c:2823:28 in .omp_outlined._debug__.72

```

 About memory leaks in AcquireMagickMemory of MagickCore/memory.c:478:10
```
==7040==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 73928 byte(s) in 18 object(s) allocated from:
    #0 0x4e53b7 in __interceptor_malloc (install/bin/magick+0x4e53b7)
    #1 0x7f26dee6f8b6 in AcquireMagickMemory MagickCore/memory.c:478:10
    #2 0x7f26dee6f91f in AcquireQuantumMemory MagickCore/memory.c:551:10
    #3 0x7f26df03be77 in AcquireString MagickCore/string.c:142:24
    #4 0x7f26df03ca21 in CloneString MagickCore/string.c:300:20
    #5 0x7f26dec7b28a in CloneDrawInfo MagickCore/draw.c:310:12
    #6 0x7f26dea7108b in AnnotateImage MagickCore/annotate.c:267:12
    #7 0x7f26dee7e6ba in MontageImageList MagickCore/montage.c:842:22
    #8 0x7f26dee78821 in MontageImages MagickCore/montage.c:316:17
    #9 0x7f26decf1ba4 in PreviewImage MagickCore/effect.c:2747:17
    #10 0x7f26de4f3581 in CLISimpleOperatorImage MagickWand/operation.c:2964:21
    #11 0x7f26de4e39b8 in CLISimpleOperatorImages MagickWand/operation.c:3685:12
    #12 0x7f26de509045 in CLIOption MagickWand/operation.c:5270:16
    #13 0x7f26de348749 in ProcessCommandOptions MagickWand/magick-cli.c:477:7
    #14 0x7f26de3499ba in MagickImageCommand MagickWand/magick-cli.c:796:5
    #15 0x7f26de3940d2 in MagickCommandGenesis MagickWand/mogrify.c:185:14
    #16 0x526fb5 in MagickMain utilities/magick.c:149:10
    #17 0x526901 in main utilities/magick.c:180:10
    #18 0x7f26d8925b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: 73928 byte(s) leaked in 18 allocation(s).

```

### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->
- ImageMagick version:
Version: ImageMagick 7.0.8-50 Q16 x86_64 2019-06-10

- Environment (Operating system, version and so on): 
Description:	Ubuntu 18.04.1 LTS
Release:	18.04
Codename: bionic

- Additional information: CC=clang-7 CXX=clang++-7 
(heap-buffer-overflow/heap-use-after-free are triggered when compiled with option '--disable-shared')
(memory leak is triggered when compiled without option '--disable-shared')
<!-- Thanks for reporting the issue to ImageMagick! -->



Comments:
Comment by SuhwanSong on 2019-06-16 13:24:08+00:00:
When I followed this [comment](https://github.com/ImageMagick/ImageMagick/issues/1589#issuecomment-502410237), ( with this option --disable-openmp) then I got similar result with this command.

run cmd:
`magick "-black-point-compensation" "-weight" "63" "(" "magick:logo" "-normalize" "-resize" "892%-38-49" ")" "(" "magick:wizard" "-preview" "Spiff" "-solarize" "35%" "-cycle" "813" ")" "(" "magick:granite" "-preview" "Blur" "-draw" ""rotate" "205"" "-colors" "109" ")" "-crop" "333x497" "-print" "-C" ""`

ASAN result.
```
==5885==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 73928 byte(s) in 18 object(s) allocated from:
    #0 0x4e5397 in __interceptor_malloc (install/bin/magick+0x4e5397)
    #1 0x7f9f122aa3d6 in AcquireMagickMemory MagickCore/memory.c:478:10
    #2 0x7f9f122aa43f in AcquireQuantumMemory MagickCore/memory.c:551:10
    #3 0x7f9f1243aec7 in AcquireString MagickCore/string.c:142:24
    #4 0x7f9f1243ba71 in CloneString MagickCore/string.c:300:20
    #5 0x7f9f12142eea in CloneDrawInfo MagickCore/draw.c:310:12
    #6 0x7f9f11f973db in AnnotateImage MagickCore/annotate.c:267:12
    #7 0x7f9f122b91da in MontageImageList MagickCore/montage.c:842:22
    #8 0x7f9f122b3341 in MontageImages MagickCore/montage.c:316:17
    #9 0x7f9f121a4424 in PreviewImage MagickCore/effect.c:2747:17
    #10 0x7f9f11a19841 in CLISimpleOperatorImage MagickWand/operation.c:2964:21
    #11 0x7f9f11a09c78 in CLISimpleOperatorImages MagickWand/operation.c:3685:12
    #12 0x7f9f11a2f305 in CLIOption MagickWand/operation.c:5270:16
    #13 0x7f9f11870a99 in ProcessCommandOptions MagickWand/magick-cli.c:477:7
    #14 0x7f9f11871d0a in MagickImageCommand MagickWand/magick-cli.c:796:5
    #15 0x7f9f118bbba1 in MagickCommandGenesis MagickWand/mogrify.c:185:14
    #16 0x526f95 in MagickMain utilities/magick.c:149:10
    #17 0x5268e1 in main utilities/magick.c:180:10
    #18 0x7f9f0c332b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: 73928 byte(s) leaked in 18 allocation(s).

```
This bug exists when compiled with --disable-openmp option.
Also the program doesn't trigger exception, but there's a memory leak.

Version: ImageMagick 7.0.8-50 Q16 x86_64 2019-06-16 https://imagemagick.org

---

Comment by urban-warrior on 2019-06-16 18:39:53+00:00:
Thanks for the problem report.  We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today.  The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.

---

Comment by SuhwanSong on 2019-06-17 04:26:39+00:00:
@urban-warrior 
Thanks for patching.

How can I get CVE from bugs I've reported?
any team in ImageMagick that reports bugs to get CVE? 

---

Comment by nohmask on 2019-07-08 01:50:20+00:00:
This was assigned CVE-2019-13301.

---

Comment by ret2libc on 2019-07-19 12:11:55+00:00:
Which commits fix this CVE?

================= Bug Report (2/2) ==================
## Source: GitHub Issue
## URL: https://github.com/ImageMagick/ImageMagick/issues/1589
## Description:
Issue: ImageMagick/ImageMagick#1589
Title: heap-use-after-free in MagickCore/resize.c and double-free in RelinquishAlignedMemory of MagickCore/memory.c
State: closed
Created by: SuhwanSong
Created at: 2019-06-11 05:31:32+00:00
Labels: bug

Issue Body:
### Prerequisites

- [x] I have written a descriptive issue title
- [x] I have verified that I am using the latest version of ImageMagick
- [x] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There are a heap-use-after-free(sometimes heap-buffer-overflow) vulnerability in MagickCore/resize.c:2604:28 in .omp_outlined._debug__.69 and a double-free bug in RelinquishAlignedMemory MagickCore/memory.c:1037:3 with the same input. 

For each run, different bugs are triggered so please run the command for several times.

related: [#1344](https://github.com/ImageMagick/ImageMagick/issues/1344)
### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
run cmd:
`magick -seed 0 -black-point-compensation -units Undefined "(" magick:granite -opaque "rgb(224,28,104)" -gaussian-blur 2 -strip  ")" "(" magick:rose -black-threshold 15 -preview Despeckle  ")" -density 3x83 -stretch ExtraCondensed -copy "937x560ls" "-52-59" ""`

This is about Heap-use-after-free in .omp_outlined._debug__.69 MagickCore/resize.c:2604:28

```
==26215==ERROR: AddressSanitizer: heap-use-after-free on address 0x62800000036c at pc 0x000000efe4dc bp 0x7f637b304e90 sp 0x7f637b304e88
READ of size 4 at 0x62800000036c thread T1
    #0 0xefe4db in .omp_outlined._debug__.69 MagickCore/resize.c:2604:28
    #1 0xeff106 in .omp_outlined..70 MagickCore/resize.c:2488:3
    #2 0x7f6383e13452 in __kmp_invoke_microtask (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x7c452)
    #3 0x7f6383dcd1b6  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x361b6)
    #4 0x7f6383dcbb20  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x34b20)
    #5 0x7f6383e0b417  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x74417)
    #6 0x7f63864476da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #7 0x7f63838af88e in clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)

0x62800000036c is located 620 bytes inside of 14400-byte region [0x628000000100,0x628000003940)
freed by thread T2 here:
    #0 0x4ef768 in __interceptor_free (install/bin/magick+0x4ef768)
    #1 0x583e5c in RelinquishAlignedMemory MagickCore/memory.c:1037:3
    #2 0xafe7c6 in RelinquishCacheNexusPixels MagickCore/cache.c:1089:12
    #3 0xb0d5db in SetPixelCacheNexusPixels MagickCore/cache.c:5080:9
    #4 0xb04b7c in GetVirtualPixelCacheNexus MagickCore/cache.c:2751:10
    #5 0xb28621 in GetCacheViewVirtualPixels MagickCore/cache-view.c:664:10
    #6 0xefd9e9 in .omp_outlined._debug__.69 MagickCore/resize.c:2542:7
    #7 0xeff106 in .omp_outlined..70 MagickCore/resize.c:2488:3
    #8 0x7f6383e13452 in __kmp_invoke_microtask (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x7c452)
    #9 0x7f6383dcd1b6  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x361b6)

previously allocated by thread T1 here:
    #0 0x4f09b0 in __interceptor_posix_memalign (install/bin/magick+0x4f09b0)
    #1 0x5822fa in AcquireAlignedMemory MagickCore/memory.c:265:7
    #2 0xb24539 in AcquireCacheNexusPixels MagickCore/cache.c:4968:37
    #3 0xb0d587 in SetPixelCacheNexusPixels MagickCore/cache.c:5076:12
    #4 0xb04b7c in GetVirtualPixelCacheNexus MagickCore/cache.c:2751:10
    #5 0xb28621 in GetCacheViewVirtualPixels MagickCore/cache-view.c:664:10
    #6 0xefd9e9 in .omp_outlined._debug__.69 MagickCore/resize.c:2542:7
    #7 0xeff106 in .omp_outlined..70 MagickCore/resize.c:2488:3
    #8 0x7f6383e13452 in __kmp_invoke_microtask (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x7c452)
    #9 0x7f6383dcd1b6  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x361b6)

Thread T1 created by T0 here:
    #0 0x43fcd0 in pthread_create (install/bin/magick+0x43fcd0)
    #1 0x7f6383e09110  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x72110)

Thread T2 created by T0 here:
    #0 0x43fcd0 in pthread_create (install/bin/magick+0x43fcd0)
    #1 0x7f6383e09110  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x72110)

SUMMARY: AddressSanitizer: heap-use-after-free MagickCore/resize.c:2604:28 in .omp_outlined._debug__.69

```

This is about the heap-buffer-overflow in .omp_outlined._debug__.69 MagickCore/resize.c:2604
```
==26841==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d00001d670 at pc 0x000000efe4dc bp 0x7f78c5104e90 sp 0x7f78c5104e88
READ of size 4 at 0x61d00001d670 thread T1
    #0 0xefe4db in .omp_outlined._debug__.69 MagickCore/resize.c:2604:28
    #1 0xeff106 in .omp_outlined..70 MagickCore/resize.c:2488:3
    #2 0x7f78cdc28452 in __kmp_invoke_microtask (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x7c452)
    #3 0x7f78cdbe21b6  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x361b6)
    #4 0x7f78cdbe0b20  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x34b20)
    #5 0x7f78cdc20417  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x74417)
    #6 0x7f78d025c6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #7 0x7f78cd6c488e in clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)

Address 0x61d00001d670 is a wild pointer.
SUMMARY: AddressSanitizer: heap-buffer-overflow MagickCore/resize.c:2604:28 in .omp_outlined._debug__.69
```


This is about double-free bug in RelinquishAlignedMemory of MagickCore/memory.c:1037:3
```
==26601==ERROR: AddressSanitizer: attempting double-free on 0x61d00001fe80 in thread T1:
    #0 0x4ef768 in __interceptor_free (install/bin/magick+0x4ef768)
    #1 0x583e5c in RelinquishAlignedMemory MagickCore/memory.c:1037:3
    #2 0xafe7c6 in RelinquishCacheNexusPixels MagickCore/cache.c:1089:12
    #3 0xb0d5db in SetPixelCacheNexusPixels MagickCore/cache.c:5080:9
    #4 0xb04b7c in GetVirtualPixelCacheNexus MagickCore/cache.c:2751:10
    #5 0xb28621 in GetCacheViewVirtualPixels MagickCore/cache-view.c:664:10
    #6 0xefd9e9 in .omp_outlined._debug__.69 MagickCore/resize.c:2542:7
    #7 0xeff106 in .omp_outlined..70 MagickCore/resize.c:2488:3
    #8 0x7fed18cb6452 in __kmp_invoke_microtask (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x7c452)
    #9 0x7fed18c701b6  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x361b6)
    #10 0x7fed18c6eb20  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x34b20)
    #11 0x7fed18cae417  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x74417)
    #12 0x7fed1b2ea6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #13 0x7fed1875288e in clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)

0x61d00001fe80 is located 0 bytes inside of 2240-byte region [0x61d00001fe80,0x61d000020740)
freed by thread T2 here:
    #0 0x4ef768 in __interceptor_free (install/bin/magick+0x4ef768)
    #1 0x583e5c in RelinquishAlignedMemory MagickCore/memory.c:1037:3
    #2 0xafe7c6 in RelinquishCacheNexusPixels MagickCore/cache.c:1089:12
    #3 0xb0d5db in SetPixelCacheNexusPixels MagickCore/cache.c:5080:9
    #4 0xb04b7c in GetVirtualPixelCacheNexus MagickCore/cache.c:2751:10
    #5 0xb28621 in GetCacheViewVirtualPixels MagickCore/cache-view.c:664:10
    #6 0xefd9e9 in .omp_outlined._debug__.69 MagickCore/resize.c:2542:7
    #7 0xeff106 in .omp_outlined..70 MagickCore/resize.c:2488:3
    #8 0x7fed18cb6452 in __kmp_invoke_microtask (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x7c452)
    #9 0x7fed18c701b6  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x361b6)

previously allocated by thread T1 here:
    #0 0x4f09b0 in __interceptor_posix_memalign (install/bin/magick+0x4f09b0)
    #1 0x5822fa in AcquireAlignedMemory MagickCore/memory.c:265:7
    #2 0xb24539 in AcquireCacheNexusPixels MagickCore/cache.c:4968:37
    #3 0xb0d587 in SetPixelCacheNexusPixels MagickCore/cache.c:5076:12
    #4 0xb04b7c in GetVirtualPixelCacheNexus MagickCore/cache.c:2751:10
    #5 0xb28621 in GetCacheViewVirtualPixels MagickCore/cache-view.c:664:10
    #6 0xefd9e9 in .omp_outlined._debug__.69 MagickCore/resize.c:2542:7
    #7 0xeff106 in .omp_outlined..70 MagickCore/resize.c:2488:3
    #8 0x7fed18cb6452 in __kmp_invoke_microtask (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x7c452)
    #9 0x7fed18c701b6  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x361b6)

Thread T1 created by T0 here:
    #0 0x43fcd0 in pthread_create (install/bin/magick+0x43fcd0)
    #1 0x7fed18cac110  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x72110)

Thread T2 created by T0 here:
    #0 0x43fcd0 in pthread_create (install/bin/magick+0x43fcd0)
    #1 0x7fed18cac110  (/usr/lib/x86_64-linux-gnu/libomp.so.5+0x72110)

SUMMARY: AddressSanitizer: double-free (install/bin/magick+0x4ef768) in __interceptor_free
==26601==ABORTING

```

### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->


- ImageMagick version:
Version: ImageMagick 7.0.8-50 Q16 x86_64 2019-06-10

- Environment (Operating system, version and so on):
Description:	Ubuntu 18.04.1 LTS
Release:	18.04
Codename: bionic

- Additional information: CC=clang-7 CXX=clang++-7

<!-- Thanks for reporting the issue to ImageMagick! -->



Comments:
Comment by dlemstra on 2019-06-11 05:44:07+00:00:
The issues that you have reported all seem to be related to omp. Maybe you could try upgrading that library to determine if that fixes the issue? I am really wondering if this is an ImageMagick issue.

---

Comment by SuhwanSong on 2019-06-11 06:11:59+00:00:
> The issues that you have reported all seem to be related to omp. Maybe you could try upgrading that library to determine if that fixes the issue? I am really wondering if this is an ImageMagick issue.

@dlemstra 
I followed this command `sudo apt-get install libomp-dev` and  libomp-dev 5.0.1-1 (latest version) is already installed. (and also I run apt-get update and upgrade) .
Then I recompiled ImageMagick with clang-7 and clang++-7 version and executed all commands that I reported and found there're still vulnerabilities in the program.




---

Comment by urban-warrior on 2019-06-16 00:53:53+00:00:
Build ImageMagick as follows:

```
./configure --disable-openmp
make install
```

Does that resolve the problem?


---

Comment by SuhwanSong on 2019-06-16 01:31:10+00:00:
@urban-warrior 
I followed your comment to reinstall it and re-ran.
I got this result from ASAN and all that I reported have memory vulnerabilities. 

```
==27142==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 36976 byte(s) in 9 object(s) allocated from:
    #0 0x4e5397 in __interceptor_malloc (install/bin/magick+0x4e5397)
    #1 0x7f01aab3e376 in AcquireMagickMemory MagickCore/memory.c:478:10
    #2 0x7f01aab3e3df in AcquireQuantumMemory MagickCore/memory.c:551:10
    #3 0x7f01aaccee67 in AcquireString MagickCore/string.c:142:24
    #4 0x7f01aaccfa11 in CloneString MagickCore/string.c:300:20
    #5 0x7f01aa9d6e8a in CloneDrawInfo MagickCore/draw.c:310:12
    #6 0x7f01aa82b3db in AnnotateImage MagickCore/annotate.c:267:12
    #7 0x7f01aab4d17a in MontageImageList MagickCore/montage.c:842:22
    #8 0x7f01aab472e1 in MontageImages MagickCore/montage.c:316:17
    #9 0x7f01aaa383c4 in PreviewImage MagickCore/effect.c:2747:17
    #10 0x7f01aa2ad841 in CLISimpleOperatorImage MagickWand/operation.c:2964:21
    #11 0x7f01aa29dc78 in CLISimpleOperatorImages MagickWand/operation.c:3685:12
    #12 0x7f01aa2c3305 in CLIOption MagickWand/operation.c:5270:16
    #13 0x7f01aa104a99 in ProcessCommandOptions MagickWand/magick-cli.c:477:7
    #14 0x7f01aa105d0a in MagickImageCommand MagickWand/magick-cli.c:796:5
    #15 0x7f01aa14fba1 in MagickCommandGenesis MagickWand/mogrify.c:185:14
    #16 0x526f95 in MagickMain utilities/magick.c:149:10
    #17 0x5268e1 in main utilities/magick.c:180:10
    #18 0x7f01a4bc6b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: 36976 byte(s) leaked in 9 allocation(s).

```

---

Comment by urban-warrior on 2019-06-16 02:15:21+00:00:
Can you check your magick-command-line?  We're trying to reproduce the problem you reported but a copy/paste of your command returns an exception.

---

Comment by SuhwanSong on 2019-06-16 02:29:44+00:00:
@urban-warrior 
I copied/pasted my command and the program returns unrecognized option exception in my case too. 
The reason I reported this issue is that it results **memory leak** with **ASAN** even though the program returns exception.

Is every issue I've reported impossible to produce memory bugs?

exception:
`magick: unrecognized option -stretch' at CLI arg 23 @ error/operation.c/CLISimpleOperatorImage/3420.
`

---

Comment by urban-warrior on 2019-06-16 17:47:25+00:00:
Thanks for the problem report.  We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today.  The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.

---

Comment by nohmask on 2019-07-08 01:50:34+00:00:
This was assigned CVE-2019-13301.

---

Comment by Kirill200889 on 2019-07-09 06:16:14+00:00:
Hello, NVD says 7.0.8-50 is the vulnerable version but it seems like 7.0.8-50 already patched and contains the commit. Can you please clarify what is fixed version and what the vulnerable versions? Thanks.

---

Comment by dlemstra on 2019-07-09 06:40:46+00:00:
This was fixed in `7.0.8-50`. We have seen this happen with a lot of other CVE's. I suspect this is happening because we increase the version number before we do the release.

---

Comment by jdelta-RBS on 2019-07-09 13:21:32+00:00:
Yeah what they're doing is looking at the researcher's "ImageMagick Version: ImageMagick 7.0.8-50 Q16 x86_64 2019-06-10" and just plugging in 7.0.8-50, rather than verifying the current release.

Build script:
#!/bin/bash
# Default build script template for C/C++ projects
set -eu

# Define configuration options
CONFIG_OPTS="--disable-shared"
CMAKE_OPTS="-DCMAKE_BUILD_TYPE=Debug"
MAKE_OPTS="-j$(nproc)"
BUILD_DIR="build"

# 1. Run build preparation scripts if they exist
for prep_script in buildconf autogen.sh bootstrap; do
  if [ -x "$prep_script" ]; then
    echo "Running $prep_script..."
    ./$prep_script
    break
  elif [ -f "$prep_script" ]; then
    echo "Found $prep_script but it's not executable, setting permissions..."
    chmod +x $prep_script
    ./$prep_script
    break
  fi
done

# 2. Handle different build systems
if [ -f "configure" ]; then
  echo "Found configure script, running with options: $CONFIG_OPTS"
  ./configure $CONFIG_OPTS

  echo "Building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "CMakeLists.txt" ]; then
  echo "Found CMakeLists.txt, using CMake build system"
  mkdir -p $BUILD_DIR
  cd $BUILD_DIR
  cmake $CMAKE_OPTS ..
  make $MAKE_OPTS
elif [ -f "Makefile" ] || [ -f "makefile" ]; then
  echo "Found Makefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "meson.build" ]; then
  echo "Found meson.build, using Meson build system"
  mkdir -p $BUILD_DIR
  meson setup $BUILD_DIR .
  cd $BUILD_DIR
  ninja
elif [ -f "GNUmakefile" ]; then
  echo "Found GNUmakefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -d ".git" ] && [ -f "Makefile.am" ]; then
  echo "Found Makefile.am, running autoreconf"
  autoreconf -i
  ./configure $CONFIG_OPTS
  make $MAKE_OPTS
else
  echo "WARNING: No recognized build system found!"
  echo "Trying generic approach:"
  
  # Try to detect common source patterns and compile them
  if ls *.c >/dev/null 2>&1 || ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
    echo "Found C/C++ source files, attempting direct compilation"
    if ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
      CXX=${CXX:-g++}
      echo "Compiling C++ sources with $CXX"
      $CXX -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.cpp *.cc 2>/dev/null || true
    elif ls *.c >/dev/null 2>&1; then
      CC=${CC:-gcc}
      echo "Compiling C sources with $CC"
      $CC -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.c 2>/dev/null || true
    fi
  fi
fi

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool pkg-config cmake nasm autopoint
RUN git clone https://github.com/imagemagick/imagemagick imagemagick
RUN git -C imagemagick checkout d08250ec50eef2fd279f6fed859f50d051e58b53
WORKDIR $SRC/imagemagick
COPY build.sh $SRC/

Additional files: