CVE requests: Multiple vulnerabilities in GraphicsMagick parsing and processing SVG files

[Gustavo Grieco <gustavo.grieco () gmail com>]

Hi,

We recently tested the last release of GraphicsMagick (1.3.23) with our
tool and found some vulnerabilities that allows to read or write outside
memory bounds (heap, stack) as well as some null-pointer derreferences to
cause DoS. All these bugs are related with the parsing and processing of
SVG files. Upstream is notified and working to fix them but in the meantime
be carefull if you process untrusted SVG files using GraphicsMagick.

Here is the summary of vulnerabilities we found. Reproducers are attached.

/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize
128x128 aaphrbkwwe.svg.-1114777018469422437 bmp:/dev/null
=================================================================
==25335==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x7fffeff75da0 at pc 0x0000005a892c bp 0x7fffffff2250 sp 0x7fffffff2248
WRITE of size 8 at 0x7fffeff75da0 thread T0
    #0 0x5a892b in TracePoint magick/render.c:5125
    #1 0x5a56a6 in TraceEllipse magick/render.c:4721
    #2 0x5a94f1 in TraceRoundRectangle magick/render.c:5191
    #3 0x59742c in DrawImage magick/render.c:2868
    #4 0x88bb1d in ReadMVGImage coders/mvg.c:195
    #5 0x498e61 in ReadImage magick/constitute.c:1607
    #6 0x94ee83 in ReadSVGImage coders/svg.c:2752
    #7 0x498e61 in ReadImage magick/constitute.c:1607
    #8 0x42690f in ConvertImageCommand magick/command.c:4348
    #9 0x442a31 in MagickCommand magick/command.c:8862
    #10 0x47ca6e in GMCommandSingle magick/command.c:17338
    #11 0x47cd2a in GMCommand magick/command.c:17391
    #12 0x40c9a5 in main utilities/gm.c:61
    #13 0x7ffff3739ec4 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #14 0x40c8b8
(/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8)


/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize
128x128 aaphrbkwwe.svg.-632425326915265752 bmp:/dev/null
=================================================================
==26846==ERROR: AddressSanitizer: stack-buffer-overflow on address
0x7fffffff8005 at pc 0x00000060ba3b bp 0x7fffffff7680 sp 0x7fffffff7678
WRITE of size 1 at 0x7fffffff8005 thread T0
    #0 0x60ba3a in GetToken magick/utility.c:2638
    #1 0x93a981 in GetUserSpaceCoordinateValue coders/svg.c:236
    #2 0x93ea73 in SVGStartElement coders/svg.c:765
    #3 0x7ffff518ca74 in xmlParseStartTag
(/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x41a74)
    #4 0x7ffff5199f92  (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ef92)
    #5 0x7ffff519af9d in xmlParseChunk
(/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ff9d)
    #6 0x94ea5d in ReadSVGImage coders/svg.c:2724
    #7 0x498e61 in ReadImage magick/constitute.c:1607
    #8 0x42690f in ConvertImageCommand magick/command.c:4348
    #9 0x442a31 in MagickCommand magick/command.c:8862
    #10 0x47ca6e in GMCommandSingle magick/command.c:17338
    #11 0x47cd2a in GMCommand magick/command.c:17391
    #12 0x40c9a5 in main utilities/gm.c:61
    #13 0x7ffff3739ec4 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #14 0x40c8b8
(/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8)

Address 0x7fffffff8005 is located in stack of thread T0 at offset 2149 in
frame
    #0 0x93a5dd in GetUserSpaceCoordinateValue coders/svg.c:210

  This frame has 2 object(s):
    [32, 40) 'p'
    [96, 2149) 'token' <== Memory access at offset 2149 overflows this
variable

/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize
128x128 aaphrbkwwe.svg.-7101924735921376511 bmp:/dev/null
ASAN:SIGSEGV
=================================================================
==26861==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x00000059866b bp 0x7fffffff7b80 sp 0x7fffffff2530 T0)
    #0 0x59866a in DrawImage magick/render.c:2999
    #1 0x88bb1d in ReadMVGImage coders/mvg.c:195
    #2 0x498e61 in ReadImage magick/constitute.c:1607
    #3 0x94ee83 in ReadSVGImage coders/svg.c:2752
    #4 0x498e61 in ReadImage magick/constitute.c:1607
    #5 0x42690f in ConvertImageCommand magick/command.c:4348
    #6 0x442a31 in MagickCommand magick/command.c:8862
    #7 0x47ca6e in GMCommandSingle magick/command.c:17338
    #8 0x47cd2a in GMCommand magick/command.c:17391
    #9 0x40c9a5 in main utilities/gm.c:61
    #10 0x7ffff3739ec4 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #11 0x40c8b8
(/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8)


/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize
128x128 aaphrbkwwe.svg.4071333061660627683 bmp:/dev/null
ASAN:SIGSEGV
=================================================================
==26881==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x000000945794 bp 0x7fffffff9540 sp 0x7fffffff8070 T0)
    #0 0x945793 in SVGStartElement coders/svg.c:1757
    #1 0x7ffff518ca74 in xmlParseStartTag
(/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x41a74)
    #2 0x7ffff5199f92  (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ef92)
    #3 0x7ffff519af9d in xmlParseChunk
(/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ff9d)
    #4 0x94ea5d in ReadSVGImage coders/svg.c:2724
    #5 0x498e61 in ReadImage magick/constitute.c:1607
    #6 0x42690f in ConvertImageCommand magick/command.c:4348
    #7 0x442a31 in MagickCommand magick/command.c:8862
    #8 0x47ca6e in GMCommandSingle magick/command.c:17338
    #9 0x47cd2a in GMCommand magick/command.c:17391
    #10 0x40c9a5 in main utilities/gm.c:61
    #11 0x7ffff3739ec4 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #12 0x40c8b8
(/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8)


/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize
128x128 aaphrbkwwe.svg.4495884156523242589 bmp:/dev/null
=================================================================
==26893==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60700000da50 at pc 0x00000093c005 bp 0x7fffffff8000 sp 0x7fffffff7ff8
WRITE of size 8 at 0x60700000da50 thread T0
    #0 0x93c004 in GetTransformTokens coders/svg.c:361
    #1 0x9455f2 in SVGStartElement coders/svg.c:1748
    #2 0x7ffff518ca74 in xmlParseStartTag
(/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x41a74)
    #3 0x7ffff5199f92  (/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ef92)
    #4 0x7ffff519af9d in xmlParseChunk
(/usr/lib/x86_64-linux-gnu/libxml2.so.2+0x4ff9d)
    #5 0x94ea5d in ReadSVGImage coders/svg.c:2724
    #6 0x498e61 in ReadImage magick/constitute.c:1607
    #7 0x42690f in ConvertImageCommand magick/command.c:4348
    #8 0x442a31 in MagickCommand magick/command.c:8862
    #9 0x47ca6e in GMCommandSingle magick/command.c:17338
    #10 0x47cd2a in GMCommand magick/command.c:17391
    #11 0x40c9a5 in main utilities/gm.c:61
    #12 0x7ffff3739ec4 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #13 0x40c8b8
(/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8)


/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm convert -resize
128x128 aaphrbkwwe.svg.7960082311810466150 bmp:/dev/null
ASAN:SIGSEGV
=================================================================
==26901==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x0000005a396d bp 0x7fffffff1a80 sp 0x7fffffff18a0 T0)
    #0 0x5a396c in TraceArcPath magick/render.c:4550
    #1 0x5a6729 in TracePath magick/render.c:4852
    #2 0x597f23 in DrawImage magick/render.c:2945
    #3 0x88bb1d in ReadMVGImage coders/mvg.c:195
    #4 0x498e61 in ReadImage magick/constitute.c:1607
    #5 0x94ee83 in ReadSVGImage coders/svg.c:2752
    #6 0x498e61 in ReadImage magick/constitute.c:1607
    #7 0x42690f in ConvertImageCommand magick/command.c:4348
    #8 0x442a31 in MagickCommand magick/command.c:8862
    #9 0x47ca6e in GMCommandSingle magick/command.c:17338
    #10 0x47cd2a in GMCommand magick/command.c:17391
    #11 0x40c9a5 in main utilities/gm.c:61
    #12 0x7ffff3739ec4 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #13 0x40c8b8
(/home/vagrant/repos/GraphicsMagick-1.3.23/utilities/gm+0x40c8b8)

Regards,
Gus.

Attachment: aaphrbkwwe.svg.-1114777018469422437
Description:

Attachment: aaphrbkwwe.svg.-632425326915265752
Description:

Attachment: aaphrbkwwe.svg.-7101924735921376511
Description:

Attachment: aaphrbkwwe.svg.4071333061660627683
Description:

Attachment: aaphrbkwwe.svg.4495884156523242589
Description:

Attachment: aaphrbkwwe.svg.7960082311810466150
Description: