CVE-2022-32547 (published 2022-06-16T18:15Z)

In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted input is processed by ImageMagick, this causes a negative impact to application availability or other problems related to undefined behavior.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-704
cwe_name: Incorrect Type Conversion or Cast
description: The product does not correctly convert an object, resource, or structure from one type to a different type.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick6
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick6
author: Cristy
author_date: 2022-04-09 08:40:54-04:00
msg: https://github.com/ImageMagick/ImageMagick/pull/5034
repository: repo_url: https://github.com/ImageMagick/ImageMagick6
repo_name: ImageMagick/ImageMagick6
description: 🧙‍♂️ ImageMagick 6
repo_language: C
owner: ImageMagick
file_changes: filename: property.c
change_type: ModificationType.MODIFY
diff: @@ -1526,12 +1526,14 @@ static MagickBooleanType GetEXIFProperty(const Image *image,
             }
             case EXIF_FMT_SINGLE:
             {
-              EXIFMultipleValues(4,"%f",(double) *(float *) p1);
+              EXIFMultipleValues(4,"%.20g",(double)
+                ReadPropertySignedLong(endian,p1));
               break;
             }
             case EXIF_FMT_DOUBLE:
             {
-              EXIFMultipleValues(8,"%f",*(double *) p1);
+              EXIFMultipleValues(8,"%.20g",(double)
+                ReadPropertySignedLong(endian,p1));
               break;
             }
             case EXIF_FMT_STRING:

programming_language: Objective-C
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: xiaoxiaoafeifei
author_date: 2022-04-09 20:34:03+08:00
msg: fix #5033: runtime error: load of misaligned address (#5034)

* fix Division by zero in XMenuWidget() of MagickCore/widget.c

* Fix memory leak in AnimateImageCommand() of MagickWand/animate.c and DisplayImageCommand() of MagickWand/display.c

* fix Division by zero in ReadEnhMetaFile() of coders/emf.c

* Resolve conflicts

* fix issue: outside the range of representable values of type 'unsigned char' at coders/psd.c:1025

* fix error: 4e+26 is outside the range of representable values of type 'unsigned long' at coders/pcl.c:299

* fix #5033:runtime error: load of misaligned address

Co-authored-by: zhailiangliang <zhailiangliang@loongson.cn>
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: property.c
change_type: ModificationType.MODIFY
diff: @@ -1545,12 +1545,12 @@ static MagickBooleanType GetEXIFProperty(const Image *image,
             }
             case EXIF_FMT_SINGLE:
             {
-              EXIFMultipleValues(4,"%f",(double) *(float *) p1);
+              EXIFMultipleValues(4,"%f",(double)ReadPropertySignedLong(endian,p1));
               break;
             }
             case EXIF_FMT_DOUBLE:
             {
-              EXIFMultipleValues(8,"%f",*(double *) p1);
+              EXIFMultipleValues(8,"%f",(double)ReadPropertySignedLong(endian,p1));
               break;
             }
             case EXIF_FMT_STRING:

programming_language: Objective-C