Crash when reading PNG file in IM 6.8.9

[vanekjar]

IM is crashes when parsing PNG file. It works in IM 6.8.8, but it crashes in 6.8.9

To try it run this command:

Code: Select all

identify -verbose invalid_image.png

It crashes with:

Code: Select all

Aborted (core dumped)

An invalid image example can be found here: https://dl.dropboxusercontent.com/u/155 ... _image.png

There is also a stacktrace:

Code: Select all

#0  0x00007ffff229fde0 in memcpy () from /lib/libc.so.6
#1  0x00007ffff780f6a7 in CopyMagickMemory (destination=0x665a00, source=0x661910, 
    size=18446744073709551615) at magick/memory.c:689
#2  0x00007ffff784100c in WriteTo8BimProfile (image=0x644f20, name=0x61f8d1 "iptc", 
    profile=0x662920) at magick/profile.c:1226
#3  0x00007ffff784176a in SetImageProfileInternal (image=0x644f20, 
    name=0x61f8d1 "iptc", profile=0x662920, recursive=MagickFalse)
    at magick/profile.c:1441
#4  0x00007ffff7841811 in SetImageProfile (image=0x644f20, name=0x61f8d1 "iptc", 
    profile=0x662920) at magick/profile.c:1455
#5  0x00007ffff79f52a3 in Magick_png_read_raw_profile (ping=0x63cc70, 
    image=0x644f20, image_info=0x610440, text=0x635740, ii=1) at coders/png.c:1964
#6  0x00007ffff79f971b in ReadOnePNGImage (mng_info=0x64a440, image_info=0x610440, 
    exception=0x604f10) at coders/png.c:3760
#7  0x00007ffff79fa357 in ReadPNGImage (image_info=0x610440, exception=0x604f10)
    at coders/png.c:4113
#8  0x00007ffff7739002 in ReadImage (image_info=0x60a0c0, exception=0x604f10)
    at magick/constitute.c:492
#9  0x00007ffff773a42b in ReadImages (image_info=0x60a0c0, exception=0x604f10)

Thank you for confirming and fixing this bug.

[magick]

We can reproduce the problem you posted and have a patch in ImageMagick 6.8.9-7 Beta available by sometime tomorrow. Thanks.

[glennrp]

Verified that the bug existed in IM-6.8.9-6 on a 64-bit Ubuntu build and is fixed in IM-6.8.9-7 and IM-7.0.0 (in the SVN repository, revision 16315). The bug was in magick/profile.c and was fixed by "Magick".

[RelaxedMaverick]

Thanks for the fix.
I hit the same issue on RHEL with IM-6.8.9-6 and updating to IM-6.8.9-7 fixes this.