Imagemagick: Null-Point reference in WriteOnePNGImage

[lcatro]

Crash Link : https://raw.githubusercontent.com/lcatro/My_PoC/master/ImageMagick/SEGV_output_mng_WriteOnePNGImage

Trigger Command : ./magick convert SEGV_output_mng_WriteOnePNGImage output.mng

Crash Detail :

fuzzing@ubuntu:~/fuzzing/ImageMagick/utilities$ ./magick convert graphicsmagick_fuzzing/SEGV-0x000000000000_output_mng_1500402017.82 output.mng
ASAN:SIGSEGV
=================================================================
==56607==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f3ea2329122 bp 0x7ffdd59968d0 sp 0x7ffdd597f460 T0)
    #0 0x7f3ea2329121 in WriteOnePNGImage coders/png.c:8494
    #1 0x7f3ea2349eba in WriteMNGImage coders/png.c:14027
    #2 0x7f3ea1d6022b in WriteImage MagickCore/constitute.c:1114
    #3 0x7f3ea1d60ea7 in WriteImages MagickCore/constitute.c:1333
    #4 0x7f3ea15b03bb in ConvertImageCommand MagickWand/convert.c:3280
    #5 0x7f3ea16a8d68 in MagickCommandGenesis MagickWand/mogrify.c:183
    #6 0x4017f1 in MagickMain utilities/magick.c:149
    #7 0x4019d2 in main utilities/magick.c:180
    #8 0x7f3ea0e1d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x401308 in _start (/home/fuzzing/fuzzing/ImageMagick/utilities/.libs/lt-magick+0x401308)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV coders/png.c:8494 WriteOnePNGImage
==56607==ABORTING

[mikayla-grace]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.

[bastien-roucaries]

Did you opened a CVE ?

[lcatro]

@bastien-roucaries no , is that you found too ?

[bastien-roucaries]

magick team could you point the commit (v7 and v6).

[bastien-roucaries]

cve should be opened here : https://cveform.mitre.org/

[lcatro]

@bastien-roucaries im found these bug in V7.0.6-1 that is the master branch code .
and i had try apply CVE but they have not give me anynews .

[attritionorg]

https://github.com/ImageMagick/ImageMagick/commit/816ecab6c532ae086ff4186b3eaf4aa7092d536f Imagine that is it and a typo on the bug number.

[carnil]

This issue has been assigned CVE-2017-11522

[dlemstra]

@attritionorg The IM7 commit is: 816ecab. There is no IM6 commit because this is an IM7 only issue.