Bugzilla – Bug 1094221
VUL-0: CVE-2017-18272: GraphicsMagick: use-after-free in ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service
Last modified: 2018-05-23 22:37:20 UTC
Created attachment 770998 [details] Reproducer CVE-2017-18272 In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted MNG image file that is mishandled in an MngInfoDiscardObject call. Our ImageMagick doesn't have this on SLES, but GM looks vulnerable Reproducer: identify -verbose use-after-free-ReadMNGImage References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-18272 http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-18272.html https://github.com/ImageMagick/ImageMagick/issues/918
BEFORE 12/ImageMagick $ valgrind -q identify -verbose use-after-free-ReadMNGImage identify: insufficient image data in file `use-after-free-ReadMNGImage' @ error/png.c/ReadOneMNGImage/5227. $ 11/ImageMagick $ valgrind -q identify -verbose use-after-free-ReadMNGImage identify: Insufficient image data in file `use-after-free-ReadMNGImage'. $ 11/GraphicsMagick $ valgrind -q gm identify -verbose use-after-free-ReadMNGImage gm identify: Corrupt image (use-after-free-ReadMNGImage). $ 12/GraphicsMagick $ valgrind -q gm identify -verbose use-after-free-ReadMNGImage gm identify: Corrupt image (use-after-free-ReadMNGImage). gm identify: Request did not return an image. $ HG/GraphicsMagick $ valgrind -q gm identify -verbose use-after-free-ReadMNGImage gm identify: Corrupt image (use-after-free-ReadMNGImage). gm identify: Request did not return an image. $ [no issues observed] PATCH https://github.com/ImageMagick/ImageMagick/commit/2460f71fcdb112dacbc14e3d9b9913dec66af820 11,12/ImageMagick: not vulnerable: if (length > 1) { [..] } chunk=(unsigned char *) RelinquishMagickMemory(chunk); continue; 42.3,11/GraphicsMagick: In ImageMagick, ReadOneMNGImage() should not free mng_info structure as ReadMNGImage() will do after return from ReadOneMNGImage() (ThrowReaderException() will do the return). In GraphicsMagick, all is done in ReadMNGImage() (no ReadOneMNGImage()) and after ThrowReaderException() will return from ReadMNGImage() happen and thus the free of mng_info is neccessary. I think no currently maintained codestream is affected.
However, see https://github.com/ImageMagick/ImageMagick/issues/1139