Null Pointer Dereference at ExpandRotateKernelInfo of MagickCore/morphology.c #774
Description
Hi all,
ImageMagick-7.0.6-5
CloneKernelInfo uses AcquireMagickMemory and it might return NULL, and causing Null Pointer Dereference and Denial of Service.
the following function ExpandRotateKernelInfo use CloneKernelInfo with out Null checking:
ImageMagick/MagickCore/morphology.c
Line 2414 in 0db4d8a
static void ExpandRotateKernelInfo(KernelInfo *kernel, const double angle)
{
KernelInfo
*clone,
*last;
last = kernel;
DisableMSCWarning(4127)
while(1) {
RestoreMSCWarning
clone = CloneKernelInfo(last); // returns NULL if it AcquireMagickMemory fails
RotateKernelInfo(clone, angle); // dereference variable clone
if ( SameKernelInfo(kernel, clone) != MagickFalse )
break;
LastKernelInfo(last)->next = clone;
last = clone;
}
clone = DestroyKernelInfo(clone); /* kernel has repeated - junk the clone */
return;
}Similar usage of CloneKernelInfo might share the same issue:
ImageMagick/MagickCore/morphology.c
Line 2336 in 0db4d8a
Regards,
Alex, SourceBrella Inc.