information on "ImageMagick PSD Images Processing RLE Decoding Buffer Overflow Vulnerability"

[Murray McAllister <mmcallis () redhat com>]

Good morning,

Does anyone have further information about 
<http://secunia.com/advisories/56844/>? (I could not get the 
http://freecode.com/projects/imagemagick/tags/bugfixes link to show 
anything useful.)

diffing ImageMagick-6.8.7/coders/psd.c ImageMagick-6.8.8/coders/psd.c:

""
@@ -1224,7 +1224,7 @@
               Allocate layered image.
             */
             layer_info[i].image=CloneImage(image,layer_info[i].page.width,
-              layer_info[i].page.height == ~0U ? 1 : 
layer_info[i].page.height,
+              layer_info[i].page.height == ~0UL ? 1 : 
layer_info[i].page.height,
               MagickFalse,&image->exception);
             if (layer_info[i].image == (Image *) NULL)
               {
@@ -2112,9 +2112,6 @@
   StringInfo
     *bim_profile;

-  unsigned char
-    layer_name[4];
-
   /*
     Open image file.
   */
@@ -2372,12 +2369,15 @@
         property=(const char *) GetImageProperty(next_image,"label");
         if (property == (const char *) NULL)
           {
+            char
+              layer_name[MaxTextExtent];
+
             (void) WriteBlobMSBLong(image,16);
             (void) WriteBlobMSBLong(image,0);
             (void) WriteBlobMSBLong(image,0);
-            (void) FormatLocaleString((char *) layer_name,MaxTextExtent,
-              "L%06ld",(long) layer_count++);
-            WritePascalString( image, (char*)layer_name, 4 );
+            (void) 
FormatLocaleString(layer_name,MaxTextExtent,"L%06ld",(long)
+              layer_count++);
+            WritePascalString(image,layer_name,4);
           }
         else
           {

""

Would the issue have been writing the amount of 6 long ints into the 4 
byte layer_name buffer?

Having a (very brief) look at ImageMagick-6.5.4 on RHEL 6, it's using 
"L%02ld" instead of "L%06ld", but that's still 4 bytes too many before 
the layer_name[MaxTextExtent]; change.

Could a CVE please be assigned if it has not been already?

Sorry for missing anything obvious.

--
Murray McAllister / Red Hat Security Response Team