Closed SuhwanSong closed 5 years ago
Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.
This was assigned CVE-2019-13296.
Prerequisites
Description
There're a direct memory leaks in AcquireMagickMemory of MagickCore/memory.c:478:10 and many indirect memory leaks.
Steps to Reproduce
run cmd:
magick -seed 0 "(" magick:netscape +repage ")" "(" magick:granite +repage ")" -append -fft -compare tmp
and this cmd also can trigger them. cmd:
magick -seed 0 -bias 0% "(" magick:rose +repage ")" "(" magick:rose -despeckle -threshold 26 -wave 55x83 ")" -sampling-factor 3.65x3.408 -channel RGBA -compare -mosaic -compare tmp
Here's ASAN result.
System Configuration
ImageMagick version: Version: ImageMagick 7.0.8-50 Q16 x86_64 2019-06-18 https://imagemagick.org
Environment (Operating system, version and so on): Description: Ubuntu 18.04.1 LTS Release: 18.04 Codename: bionic
Additional information: CC=clang-7 CXX=clang++-7 ./configure --disable-openmp