Page 1 of 1

Prevent 0x0 Sized Images

Posted: 2014-10-21T08:46:23-07:00
by magick
Add this patch to the ImageMagick source distribution to prevent ingesting images of size 0x0:

Code: Select all

*** magick/image.c~     2014-10-21 11:41:52.381602505 -0400
--- magick/image.c      2014-10-21 09:55:56.024220041 -0400
***************
*** 801,806 ****
--- 801,812 ----
      (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
    assert(exception != (ExceptionInfo *) NULL);
    assert(exception->signature == MagickSignature);
+   if ((image->columns == 0) || (image->rows == 0))
+     {
+       (void) ThrowMagickException(exception,GetMagickModule(),CorruptImageError,
+         "NegativeOrZeroImageSize","`%s'",image->filename);
+       return((Image *) NULL);
+     }
    clone_image=(Image *) AcquireMagickMemory(sizeof(*clone_image));
    if (clone_image == (Image *) NULL)
      ThrowImageException(ResourceLimitError,"MemoryAllocationFailed");
Patch already applied to ImageMagick 6.8.9-9 Beta. Thanks to Hanno Böck for bringing this problem to our attention.

Re: Prevent 0x0 Sized Images

Posted: 2014-10-21T12:44:34-07:00
by broucaries
I suppose they are security problem with this kind of stuff....

Do you have some idea of exploitation ? (please send me a private mail).

If so do you plan to ask for a CVE ?

What is the affected version ?

Bastien

Re: Prevent 0x0 Sized Images

Posted: 2014-10-21T13:25:34-07:00
by magick
Hanno Böck has requested a CVE for this and a PCX bug which we will have a fix for by sometime tomorrow.

Re: Prevent 0x0 Sized Images

Posted: 2014-10-22T10:02:59-07:00
by broucaries
Could you send me a private mail about the pcx issue ?

Will ask for three CVE

Re: Prevent 0x0 Sized Images

Posted: 2014-10-22T11:33:07-07:00
by magick
You got it and thanks.