Comment 3 for bug 1448803

Revision history for this message
Moshe Kaplan (moshekaplan) wrote :

I did, a copy of the message is included below. I also verified that the bug is present in the newest release of Imagemagick, ImageMagick-6.9.1-3.

Double free in coders/pict.c:2042
Command: convert pict_double_free.pict /dev/null

Version: ImageMagick-6.9.1-3

Sample file available here: http://moshekaplan.com/files/pict_double_free.pict

Launchpad bug report available here: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1448803

gdb output:
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".
*** Error in `/home/user/Desktop/ImageMagick-6.9.1-3/utilities/.libs/lt-convert': double free or corruption (out): 0x08096dc0 ***
[New Thread 0xb42eeb40 (LWP 20831)]

Program received signal SIGABRT, Aborted.

Stack Trace:
--------------------------------------------------------------------------------
gdb$ bt
#0 0xffffffff in __kernel_vsyscall ()
#1 0xffffffff in __GI_raise (sig=0x6) at ../sysdeps/unix/sysv/linux/raise.c:55
#2 0xffffffff in __GI_abort () at abort.c:89
#3 0xffffffff in __libc_message (do_abort=0x1, fmt=0xb789d444 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#4 0xffffffff in malloc_printerr (action=<optimized out>, str=0xb789d4fc "double free or corruption (out)", ptr=0x8096dc0) at malloc.c:4965
#5 0xffffffff in _int_free (av=0xb78f0840 <main_arena>, p=<optimized out>, have_lock=0x0) at malloc.c:3834
#6 0xffffffff in RelinquishMagickMemory (memory=0x8096dc0) at magick/memory.c:956
#7 0xffffffff in WritePICTImage (image_info=0x8083f08, image=0x8083f08) at coders/pict.c:2042
#8 0xffffffff in WriteImage (image_info=0x1, image=0x8083f08) at magick/constitute.c:1184
#9 0xffffffff in WriteImages (image_info=0x0, images=0x8083f08, filename=0x0, exception=0x80535d8) at magick/constitute.c:1325
#10 0xffffffff in ConvertImageCommand (image_info=0x80870d0, argc=0x3, argv=0x8054d28, metadata=0x0, exception=0x80535d8) at wand/convert.c:3217
#11 0xffffffff in MagickCommandGenesis (image_info=0x8055488, command=0x8048620 <ConvertImageCommand@plt>, argc=0x3, argv=0xbffff054, metadata=0x0, exception=0x80535d8) at wand/mogrify.c:168
#12 0x080486ec in main (argv=0xbffff054, argc=<optimized out>) at utilities/convert.c:81
#13 0x080486ec in main (argc=0x3, argv=0xbffff054) at utilities/convert.c:92