{"id":2072,"date":"2017-09-06T15:42:04","date_gmt":"2017-09-06T13:42:04","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=2072"},"modified":"2017-09-06T20:52:12","modified_gmt":"2017-09-06T18:52:12","slug":"graphicsmagick-memory-allocation-failure-in-magickmalloc-memory-c-2","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/09\/06\/graphicsmagick-memory-allocation-failure-in-magickmalloc-memory-c-2\/","title":{"rendered":"graphicsmagick: memory allocation failure in MagickMalloc (memory.c)"},"content":{"rendered":"

Description<\/strong>:
\ngraphicsmagick<\/a> is a collection of tools and libraries for many image formats.<\/p>\n

The relevant ASan output of the issue:<\/p>\n

# gm convert -negate -clip $file out\r\n==25373==End of process memory map.\r\n==25373==AddressSanitizer CHECK failed: \/var\/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.1\/work\/compiler-rt-4.0.1.src\/lib\/sanitizer_common\/sanitizer_common.cc:120 \"((0 && \"unable to mmap\")) != (0)\" (0x0, 0x0)\r\n    #0 0x4d966f in AsanCheckFailed \/var\/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.1\/work\/compiler-rt-4.0.1.src\/lib\/asan\/asan_rtl.cc:69\r\n    #1 0x4f43d5 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) \/var\/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.1\/work\/compiler-rt-4.0.1.src\/lib\/sanitizer_common\/sanitizer_termination.cc:79\r\n    #2 0x4e3a02 in __sanitizer::ReportMmapFailureAndDie(unsigned long, char const*, char const*, int, bool) \/var\/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.1\/work\/compiler-rt-4.0.1.src\/lib\/sanitizer_common\/sanitizer_common.cc:120\r\n    #3 0x4ed305 in __sanitizer::MmapOrDie(unsigned long, char const*, bool) \/var\/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.1\/work\/compiler-rt-4.0.1.src\/lib\/sanitizer_common\/sanitizer_posix.cc:132\r\n    #4 0x420a02 in __sanitizer::LargeMmapAllocator::Allocate(__sanitizer::AllocatorStats*, unsigned long, unsigned long) \/var\/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.1\/work\/compiler-rt-4.0.1.src\/lib\/asan\/..\/sanitizer_common\/sanitizer_allocator_secondary.h:41\r\n    #5 0x420a02 in __sanitizer::CombinedAllocator<__sanitizer::SizeClassAllocator64, __sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64 >, __sanitizer::LargeMmapAllocator >::Allocate(__sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64 >*, unsigned long, unsigned long, bool, bool) \/var\/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.1\/work\/compiler-rt-4.0.1.src\/lib\/asan\/..\/sanitizer_common\/sanitizer_allocator_combined.h:70\r\n    #6 0x420a02 in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) \/var\/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.1\/work\/compiler-rt-4.0.1.src\/lib\/asan\/asan_allocator.cc:407\r\n    #7 0x420a02 in __asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*) \/var\/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.1\/work\/compiler-rt-4.0.1.src\/lib\/asan\/asan_allocator.cc:782\r\n    #8 0x4cf664 in malloc \/var\/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.1\/work\/compiler-rt-4.0.1.src\/lib\/asan\/asan_malloc_linux.cc:67\r\n    #9 0x7fc323f784d6 in MagickMalloc \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/memory.c:156:10\r\n    #10 0x7fc31e2b41a3 in ReadSUNImage \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/coders\/sun.c:549:20\r\n    #11 0x7fc323b96e88 in ReadImage \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/constitute.c:1607:13\r\n    #12 0x7fc323a29f18 in ConvertImageCommand \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/command.c:4348:22\r\n    #13 0x7fc323a660c5 in MagickCommand \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/command.c:8869:17\r\n    #14 0x7fc323b1185b in GMCommandSingle \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/command.c:17396:10\r\n    #15 0x7fc323b0e991 in GMCommand \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/command.c:17449:16\r\n    #16 0x7fc322379680 in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.23-r4\/work\/glibc-2.23\/csu\/..\/csu\/libc-start.c:289\r\n    #17 0x419cd8 in _init (\/usr\/bin\/gm+0x419cd8)\r\n\r\n\/usr\/bin\/gm convert: abort due to signal 6 (SIGABRT) \"Abort\"...\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n1.3.26<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nhttp:\/\/hg.code.sf.net\/p\/graphicsmagick\/code\/rev\/493da54370aa<\/a><\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-14165<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00334-graphicsmagick-memallocfailure-MagickMalloc<\/a><\/p>\n
Timeline:<\/strong>
\n2017-07-14: bug discovered and reported to upstream privately
\n2017-08-16: bug reported to the public upstream bugtracker
\n2017-08-20: upstream released a fix
\n2017-09-06: blog post about the issue
\n2017-09-06: CVE assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.
\nThis bug was identified with bare metal servers donated by Packet<\/a>. This work is also supported by the Core Infrastructure Initiative<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
graphicsmagick: memory allocation failure in MagickMalloc (memory.c)<\/a><\/p><\/blockquote>\n