Описание
ImageMagick has a NULL pointer dereference in MSL parser via tag before image load
Summary
NULL pointer dereference in MSL (Magick Scripting Language) parser when processing <comment> tag before any image is loaded.
Version
- ImageMagick 7.x (tested on current main branch)
- Commit: HEAD
Steps to Reproduce
Method 1: Using ImageMagick directly
Method 2: Using OSS-Fuzz reproduce
Or run the fuzzer directly:
Expected Behavior
ImageMagick should handle the malformed MSL gracefully and return an error message.
Actual Behavior
Root Cause Analysis
In coders/msl.c:7091, MSLEndElement() calls DeleteImageProperty() on msl_info->image[n] when handling the </comment> end tag without checking if the image is NULL:
When <comment> appears before any <read> operation, msl_info->image[n] is NULL, causing the assertion failure in DeleteImageProperty() at property.c:297.
Impact
- DoS: Crash via assertion failure (debug builds) or NULL pointer dereference (release builds)
- Affected: Any application using ImageMagick to process user-supplied MSL files
Fuzzer
This issue was discovered using a custom MSL fuzzer:
This issue was found by Team FuzzingBrain @ Texas A&M University
Пакеты
Magick.NET-Q8-x64
< 14.10.2
14.10.2
Magick.NET-Q8-arm64
< 14.10.2
14.10.2
Magick.NET-Q8-x86
< 14.10.2
14.10.2
Magick.NET-Q8-OpenMP-x64
< 14.10.2
14.10.2
Magick.NET-Q8-OpenMP-arm64
< 14.10.2
14.10.2
Magick.NET-Q16-x64
< 14.10.2
14.10.2
Magick.NET-Q16-arm64
< 14.10.2
14.10.2
Magick.NET-Q16-x86
< 14.10.2
14.10.2
Magick.NET-Q16-OpenMP-x64
< 14.10.2
14.10.2
Magick.NET-Q16-OpenMP-arm64
< 14.10.2
14.10.2
Magick.NET-Q16-OpenMP-x86
< 14.10.2
14.10.2
Magick.NET-Q16-HDRI-x64
< 14.10.2
14.10.2
Magick.NET-Q16-HDRI-arm64
< 14.10.2
14.10.2
Magick.NET-Q16-HDRI-x86
< 14.10.2
14.10.2
Magick.NET-Q16-HDRI-OpenMP-x64
< 14.10.2
14.10.2
Magick.NET-Q16-HDRI-OpenMP-arm64
< 14.10.2
14.10.2
Magick.NET-Q8-AnyCPU
< 14.10.2
14.10.2
Magick.NET-Q16-AnyCPU
< 14.10.2
14.10.2
Magick.NET-Q16-HDRI-AnyCPU
< 14.10.2
14.10.2
Связанные уязвимости
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2.
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2.
ImageMagick is free and open-source software used for editing and mani ...
