Legacy ImageMagick Discussions Archive

Doesn't crash for me on Ubuntu 14.04 amd64 with IM 6.9.0-1 Beta or the IM 6.7.7ubuntu from the main Ubuntu repo.

Tested 12/15/2014 with http://www.imagemagick.org/download/bet ... 215.tar.gz Result: Pass

Tested 12/15/2014 with http://www.imagemagick.org/download/bet ... 215.tar.gz Result: Fail

Tested 12/15/2014 with http://www.imagemagick.org/download/bet ... 215.tar.gz Result: Fail

Tested 12/15/2014 with http://www.imagemagick.org/download/bet ... 215.tar.gz Result: Fail

Tested 12/15/2014 with http://www.imagemagick.org/download/bet ... 215.tar.gz Result: Fail

Tested 12/15/2014 with http://www.imagemagick.org/download/bet ... 215.tar.gz Result: Fail

Source file: https://www.dropbox.com/s/07nyi99s7wwivyg/f56e9710?dl=0 To reproduce: convert f56e9710 png:/dev/null Running this on my systems uses 100% CPU and will run for minutes until I kill the process. BT during the 100%: #0 ReadBlobByte (image=0x648010) at magick/blob.c:3008 #1 0x00007ffff795f2...

Source file: https://www.dropbox.com/s/dd10m6b3u4e21gi/5c825062?dl=0 To reproduce: convert 5c825062 png:/dev/null Output: Aborted (core dumped) BT: Program terminated with signal SIGABRT, Aborted. #0 0x00007ffff604ebb9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 ...

It crashes the same way on my laptop, running IM 6.7.7.10-6ubuntu3.

My 6.9.0-1 Beta was downloaded from http://www.imagemagick.org/download/bet ... -1.tar.bz2 ... are you by any chance running something newer on your system? I want to test with what you test with...

Source file: https://www.dropbox.com/s/a218rgxd4srwe9y/d54227aa?dl=0 To reproduce: convert d54227aa png:/dev/null Output: *** Error in `convert': realloc(): invalid next size: 0x0000000000647bd0 *** Aborted (core dumped) System Details: AMD64 Distributor ID: Ubuntu Description: Ubuntu 14.04.1 LTS Re...

Source file: https://www.dropbox.com/s/oxsjh2dcfmn6oq6/36b70be2?dl=0 To reproduce: convert 36b70be2 png:/dev/null Output: Aborted (core dumped) System Details: AMD64 Distributor ID: Ubuntu Description: Ubuntu 14.04.1 LTS Release: 14.04 Codename: trusty ImageMagick 6.9.0-1 Beta compiled from source. ...

I'll start my work on IM 6.9.0-1 Beta then.

Source file: https://www.dropbox.com/s/tjopl2rafgone2h/3677a9ec?dl=0 To reproduce: convert 3677a9ec png:/dev/null Output: *** Error in `convert': realloc(): invalid next size: 0x0000000000644b60 *** Aborted System Details: AMD64 Distributor ID: Ubuntu Description: Ubuntu 14.04.1 LTS Release: 14.04 C...

broucaries wrote:Another security bug (dos) i suppose...

Yep, with more to come. I used AFL(http://lcamtuf.coredump.cx/afl/) for this.