[Overflow.pl] ImageMagick ReadSGIImage() Heap Overflow

Type securityvulns
Reporter Securityvulns
Modified 2006-08-15T00:00:00


Overflow.pl Security Advisory #7

ImageMagick ReadSGIImage() Heap Overflow

Vendor: ImageMagick (http://www.imagemagick.org) Affected version: 6.x up to and including 6.2.8 Vendor status: Fixed version released (6.2.9)

Author: Damian Put <pucik@overflow.pl> URL: http://www.overflow.pl/adv/imsgiheap.txt Date: 14.08.2006

  1. Background

ImageMagick is a free software suite to create, edit, and compose bitmap images. It can read, convert and write images in a large variety of formats.


  1. Description

Remote exploitation of a heap overflow vulnerability could allow execution of arbitrary code or couse denial of service.

A heap overflow exists in ReadSGIImage() function, that is used to decode a SGI image file. The vulnerable code is:


static Image ReadSGIImage(const ImageInfo image_info,ExceptionInfo exception) { ... iris_info.bytes_per_pixel=(unsigned char) ReadBlobByte(image); ... image->columns=iris_info.columns; image->rows=iris_info.rows; ... bytes_per_pixel=(size_t) iris_info.bytes_per_pixel; number_pixels=(MagickSizeType) iris_info.columnsiris_info.rows; ... iris_pixels=(unsigned char )AcquireMagickMemory (4bytes_per_pixeliris_info.columnsiris_info.rows);

We can manipalute iris_info.rows, iris_info.columns and bytes_per_pixel value. Allocation of memory to "iris_pixels" is based on this values. When rowscolsbytes_per_pixe*4 overflow integer variable, we can alloc not enough memory for next operations, and cause heap overflow.

  1. PoC

Example crafted SGI file: http://overflow.pl/poc/imheap.sgi

[pucik@overflow ImageMagick-6.2.8]$ display imheap.sgi glibc detected free(): invalid next size (fast): 0x08055dd0 *** Abort (core dumped) [pucik@overflow ImageMagick-6.2.8]$