{"id":1574,"date":"2017-04-02T16:03:30","date_gmt":"2017-04-02T14:03:30","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1574"},"modified":"2017-04-10T09:21:44","modified_gmt":"2017-04-10T07:21:44","slug":"imagemagick-undefined-behavior-in-codersrle-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/04\/02\/imagemagick-undefined-behavior-in-codersrle-c\/","title":{"rendered":"imagemagick: undefined behavior in coders\/rle.c"},"content":{"rendered":"<p><strong>Description<\/strong>:<br \/>\n<a href=\"http:\/\/www.imagemagick.org\/script\/index.php\">imagemagick<\/a> is a software suite to create, edit, compose, or convert bitmap images.<\/p>\n<p>A fuzz with the upstream <a href=\"http:\/\/www.imagemagick.org\/script\/security-policy.php\">security policy<\/a> enabled, a quantum of 32 and the undefined behavior sanitizer discovered this bug.<\/p>\n<pre><font size=\"2\"># identify $FILE\r\ncoders\/rle.c:274:18: runtime error: value 1.72801e+09 is outside the range of representable values of type 'unsigned char'                                                                     \r\n<\/font><\/pre>\n<p><strong>Affected version:<\/strong><br \/>\n7.0.5.4<\/p>\n<p><strong>Fixed version:<\/strong><br \/>\n7.0.5.5 (not released atm)<\/p>\n<p><strong>Commit fix:<\/strong><br \/>\n<a href=\"https:\/\/github.com\/ImageMagick\/ImageMagick\/commit\/b218117cad34d39b9ffb587b45c71c5a49b12bde\">https:\/\/github.com\/ImageMagick\/ImageMagick\/commit\/b218117cad34d39b9ffb587b45c71c5a49b12bde<\/a><\/p>\n<p><strong>Credit:<\/strong><br \/>\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n<p><strong>CVE:<\/strong><br \/>\nCVE-2017-7606<\/p>\n<p><strong>Reproducer:<\/strong><br \/>\n<a href=\"https:\/\/github.com\/asarubbo\/poc\/blob\/master\/00253-imagemagick-outsinde-unsigned-char\">https:\/\/github.com\/asarubbo\/poc\/blob\/master\/00253-imagemagick-outside-unsigned-char<\/a><\/p>\n<p><strong>Timeline:<\/strong><br \/>\n2017-03-31: bug discovered and reported to upstream<br \/>\n2017-03-31: upstream released a patch<br \/>\n2017-04-02: blog post about the issue<br \/>\n2017-04-09: CVE assigned<\/p>\n<p><strong>Note:<\/strong><br \/>\nThis bug was found with <a href=\"http:\/\/lcamtuf.coredump.cx\/afl\">American Fuzzy Lop<\/a>.<\/p>\n<p><strong>Permalink:<\/strong><\/p>\n<blockquote data-secret=\"tpxc7UJkMZ\" class=\"wp-embedded-content\"><p><a href=\"https:\/\/blogs.gentoo.org\/ago\/2017\/04\/02\/imagemagick-undefined-behavior-in-codersrle-c\/\">imagemagick: undefined behavior in coders\/rle.c<\/a><\/p><\/blockquote>\n<p><iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" src=\"https:\/\/blogs.gentoo.org\/ago\/2017\/04\/02\/imagemagick-undefined-behavior-in-codersrle-c\/embed\/#?secret=tpxc7UJkMZ\" data-secret=\"tpxc7UJkMZ\" width=\"600\" height=\"338\" title=\"&#8220;imagemagick: undefined behavior in coders\/rle.c&#8221; &#8212; agostino&#039;s blog\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Description: imagemagick is a software suite to create, edit, compose, or convert bitmap images. A fuzz with the upstream security policy enabled, a quantum of 32 and the undefined behavior sanitizer discovered this bug. # identify $FILE coders\/rle.c:274:18: runtime error: &hellip; <a href=\"https:\/\/blogs.gentoo.org\/ago\/2017\/04\/02\/imagemagick-undefined-behavior-in-codersrle-c\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":140,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[12,10],"tags":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p2EaBc-po","_links":{"self":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1574"}],"collection":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/users\/140"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/comments?post=1574"}],"version-history":[{"count":5,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1574\/revisions"}],"predecessor-version":[{"id":1615,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1574\/revisions\/1615"}],"wp:attachment":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/media?parent=1574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/categories?post=1574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/tags?post=1574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}