Listen to this Post
The vulnerability is within the `Options::fontFamily` method in the Magick++ C++ API. When invoked with an empty string argument, the method incorrectly frees the memory pointed to by `_drawInfo->font` via RelinquishMagickMemory, but leaves the `_drawInfo->font` pointer itself unchanged and now dangling. Simultaneously, `_drawInfo->family` is assigned this same invalid pointer. Subsequent operations, such as cleanup in `DestroyDrawInfo` or calls to other font setters like Options::font, will then use or free this already-freed memory. This leads to classic Use After Free (CWE-416) and Double Free (CWE-415) conditions, causing application crashes, heap corruption, and potential arbitrary code execution. The bug is isolated to the library’s C++ interface and is not reachable via command-line tools like convert.
Platform: ImageMagick Magick++
Version: 7.0.1-0+
Vulnerability : Use After Free
Severity: Critical
date: Introduced 2015-08-01
Prediction: Patch date unknown.
What Undercode Say:
Analytics:
git blame -L 313,313 Magick++/lib/Options.cpp
// Vulnerable code in Options::fontFamily
if (family_.length() == 0) {
_drawInfo->family=(char ) RelinquishMagickMemory(_drawInfo->font);
}
// Proposed fix _drawInfo->family=(char ) RelinquishMagickMemory(_drawInfo->family);
How Exploit:
Craft C++ program calling Options::fontFamily(""). Trigger subsequent DestroyDrawInfo. Achieve heap corruption for potential code execution.
Protection from this CVE
Apply provided patch. Nullify `_drawInfo->font` after freeing. Avoid empty string arguments to fontFamily.
Impact:
Denial-of-service, remote code execution, heap corruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
