{"action":"created","issue":{"url":"https://api.github.com/repos/ImageMagick/ImageMagick/issues/267","repository_url":"https://api.github.com/repos/ImageMagick/ImageMagick","labels_url":"https://api.github.com/repos/ImageMagick/ImageMagick/issues/267/labels{/name}","comments_url":"https://api.github.com/repos/ImageMagick/ImageMagick/issues/267/comments","events_url":"https://api.github.com/repos/ImageMagick/ImageMagick/issues/267/events","html_url":"https://github.com/ImageMagick/ImageMagick/issues/267","id":176910691,"number":267,"title":"memory allocation failure in AcquireAlignedMemory ( memory.c)","user":{"login":"asarubbo","id":4741819,"avatar_url":"https://avatars.githubusercontent.com/u/4741819?v=3","gravatar_id":"","url":"https://api.github.com/users/asarubbo","html_url":"https://github.com/asarubbo","followers_url":"https://api.github.com/users/asarubbo/followers","following_url":"https://api.github.com/users/asarubbo/following{/other_user}","gists_url":"https://api.github.com/users/asarubbo/gists{/gist_id}","starred_url":"https://api.github.com/users/asarubbo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asarubbo/subscriptions","organizations_url":"https://api.github.com/users/asarubbo/orgs","repos_url":"https://api.github.com/users/asarubbo/repos","events_url":"https://api.github.com/users/asarubbo/events{/privacy}","received_events_url":"https://api.github.com/users/asarubbo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-09-14T13:41:44Z","updated_at":"2016-09-15T08:24:59Z","closed_at":null,"body":"A crafted image causes a memory allocation failure.\r\nReproduce with: identify $FILE\r\nI'm attaching the testcase as a zip because of the github's limitation.\r\nTested on 7.0.3.0\r\n\r\n```\r\n==24975==ERROR: AddressSanitizer failed to allocate 0xc58e4000 (3314434048) bytes of LargeMmapAllocator (error code: 12)\r\n==24975==Process memory map follows:\r\n        0x000000400000-0x000000520000   /usr/bin/magick\r\n        0x000000720000-0x000000721000   /usr/bin/magick\r\n        0x000000721000-0x000000724000   /usr/bin/magick\r\n        0x000000724000-0x000001397000\r\n        0x00007fff7000-0x00008fff7000\r\n        0x00008fff7000-0x02008fff7000\r\n        0x02008fff7000-0x10007fff8000\r\n        0x600000000000-0x602000000000\r\n        0x602000000000-0x602000010000\r\n        0x602000010000-0x603000000000\r\n        0x603000000000-0x603000010000\r\n        0x603000010000-0x604000000000\r\n        0x604000000000-0x604000010000\r\n        0x604000010000-0x606000000000\r\n        0x606000000000-0x606000010000\r\n        0x606000010000-0x607000000000\r\n        0x607000000000-0x607000010000\r\n        0x607000010000-0x608000000000\r\n        0x608000000000-0x608000010000\r\n        0x608000010000-0x60a000000000\r\n        0x60a000000000-0x60a000020000\r\n        0x60a000020000-0x60b000000000\r\n        0x60b000000000-0x60b000010000\r\n        0x60b000010000-0x60c000000000\r\n        0x60c000000000-0x60c000010000\r\n        0x60c000010000-0x60e000000000\r\n        0x60e000000000-0x60e000010000\r\n        0x60e000010000-0x60f000000000\r\n        0x60f000000000-0x60f000010000\r\n        0x60f000010000-0x610000000000\r\n        0x610000000000-0x610000010000\r\n        0x610000010000-0x611000000000\r\n        0x611000000000-0x611000010000\r\n        0x611000010000-0x612000000000\r\n        0x612000000000-0x612000010000\r\n        0x612000010000-0x614000000000\r\n        0x614000000000-0x614000020000\r\n        0x614000020000-0x615000000000\r\n        0x615000000000-0x615000020000\r\n        0x615000020000-0x616000000000\r\n        0x616000000000-0x616000020000\r\n        0x616000020000-0x618000000000\r\n        0x618000000000-0x618000020000\r\n        0x618000020000-0x619000000000\r\n        0x619000000000-0x619000020000\r\n        0x619000020000-0x61a000000000\r\n        0x61a000000000-0x61a000020000\r\n        0x61a000020000-0x61b000000000\r\n        0x61b000000000-0x61b000020000\r\n        0x61b000020000-0x61d000000000\r\n        0x61d000000000-0x61d000020000\r\n        0x61d000020000-0x621000000000\r\n        0x621000000000-0x621000020000\r\n        0x621000020000-0x622000000000\r\n        0x622000000000-0x622000020000\r\n        0x622000020000-0x623000000000\r\n        0x623000000000-0x623000020000\r\n        0x623000020000-0x624000000000\r\n        0x624000000000-0x624000020000\r\n        0x624000020000-0x625000000000\r\n        0x625000000000-0x625000020000\r\n        0x625000020000-0x627000000000\r\n        0x627000000000-0x627000030000\r\n        0x627000030000-0x629000000000\r\n        0x629000000000-0x629000010000\r\n        0x629000010000-0x640000000000\r\n        0x640000000000-0x640000003000\r\n        0x7f56bea76000-0x7f56bea8d000   /usr/lib64/ImageMagick-7.0.3/modules-Q64HDRI/coders/pcx.so\r\n        0x7f56bea8d000-0x7f56bec8c000   /usr/lib64/ImageMagick-7.0.3/modules-Q64HDRI/coders/pcx.so\r\n        0x7f56bec8c000-0x7f56bec8d000   /usr/lib64/ImageMagick-7.0.3/modules-Q64HDRI/coders/pcx.so\r\n        0x7f56bec8d000-0x7f56bec8e000   /usr/lib64/ImageMagick-7.0.3/modules-Q64HDRI/coders/pcx.so\r\n        0x7f56bec8e000-0x7f56c5300000   /usr/lib64/locale/locale-archive\r\n        0x7f56c5300000-0x7f56c5400000\r\n        0x7f56c5500000-0x7f56c5600000\r\n        0x7f56c569e000-0x7f56c79f0000\r\n        0x7f56c79f0000-0x7f56c7a17000   /usr/lib64/libexpat.so.1.6.0\r\n        0x7f56c7a17000-0x7f56c7c16000   /usr/lib64/libexpat.so.1.6.0\r\n        0x7f56c7c16000-0x7f56c7c19000   /usr/lib64/libexpat.so.1.6.0\r\n        0x7f56c7c19000-0x7f56c7c1a000   /usr/lib64/libexpat.so.1.6.0\r\n        0x7f56c7c1a000-0x7f56c7d4f000   /usr/lib64/libglib-2.0.so.0.4600.2\r\n        0x7f56c7d4f000-0x7f56c7f4f000   /usr/lib64/libglib-2.0.so.0.4600.2\r\n        0x7f56c7f4f000-0x7f56c7f50000   /usr/lib64/libglib-2.0.so.0.4600.2\r\n        0x7f56c7f50000-0x7f56c7f51000   /usr/lib64/libglib-2.0.so.0.4600.2\r\n        0x7f56c7f51000-0x7f56c7f52000\r\n        0x7f56c7f52000-0x7f56c7f5b000   /usr/lib64/libltdl.so.7.3.1\r\n        0x7f56c7f5b000-0x7f56c815a000   /usr/lib64/libltdl.so.7.3.1\r\n        0x7f56c815a000-0x7f56c815b000   /usr/lib64/libltdl.so.7.3.1\r\n        0x7f56c815b000-0x7f56c815c000   /usr/lib64/libltdl.so.7.3.1\r\n        0x7f56c815c000-0x7f56c8171000   /lib64/libz.so.1.2.8\r\n        0x7f56c8171000-0x7f56c8370000   /lib64/libz.so.1.2.8\r\n        0x7f56c8370000-0x7f56c8371000   /lib64/libz.so.1.2.8\r\n        0x7f56c8371000-0x7f56c8372000   /lib64/libz.so.1.2.8\r\n        0x7f56c8372000-0x7f56c8381000   /lib64/libbz2.so.1.0.6\r\n        0x7f56c8381000-0x7f56c8580000   /lib64/libbz2.so.1.0.6\r\n        0x7f56c8580000-0x7f56c8581000   /lib64/libbz2.so.1.0.6\r\n        0x7f56c8581000-0x7f56c8582000   /lib64/libbz2.so.1.0.6\r\n        0x7f56c8582000-0x7f56c8629000   /usr/lib64/libfreetype.so.6.12.3\r\n        0x7f56c8629000-0x7f56c8829000   /usr/lib64/libfreetype.so.6.12.3\r\n        0x7f56c8829000-0x7f56c882f000   /usr/lib64/libfreetype.so.6.12.3\r\n        0x7f56c882f000-0x7f56c8830000   /usr/lib64/libfreetype.so.6.12.3\r\n        0x7f56c8830000-0x7f56c886b000   /usr/lib64/libfontconfig.so.1.8.0\r\n        0x7f56c886b000-0x7f56c8a6a000   /usr/lib64/libfontconfig.so.1.8.0\r\n        0x7f56c8a6a000-0x7f56c8a6c000   /usr/lib64/libfontconfig.so.1.8.0\r\n        0x7f56c8a6c000-0x7f56c8a6d000   /usr/lib64/libfontconfig.so.1.8.0\r\n        0x7f56c8a6d000-0x7f56c8c62000   /usr/lib64/libfftw3.so.3.4.4\r\n        0x7f56c8c62000-0x7f56c8e61000   /usr/lib64/libfftw3.so.3.4.4\r\n        0x7f56c8e61000-0x7f56c8e75000   /usr/lib64/libfftw3.so.3.4.4\r\n        0x7f56c8e75000-0x7f56c8e76000   /usr/lib64/libfftw3.so.3.4.4\r\n        0x7f56c8e76000-0x7f56c8e84000   /usr/lib64/liblqr-1.so.0.3.2\r\n        0x7f56c8e84000-0x7f56c9083000   /usr/lib64/liblqr-1.so.0.3.2\r\n        0x7f56c9083000-0x7f56c9084000   /usr/lib64/liblqr-1.so.0.3.2\r\n        0x7f56c9084000-0x7f56c9085000   /usr/lib64/liblqr-1.so.0.3.2\r\n        0x7f56c9085000-0x7f56c90d8000   /usr/lib64/liblcms2.so.2.0.6\r\n        0x7f56c90d8000-0x7f56c92d8000   /usr/lib64/liblcms2.so.2.0.6\r\n        0x7f56c92d8000-0x7f56c92d9000   /usr/lib64/liblcms2.so.2.0.6\r\n        0x7f56c92d9000-0x7f56c92de000   /usr/lib64/liblcms2.so.2.0.6\r\n        0x7f56c92de000-0x7f56c9471000   /lib64/libc-2.22.so\r\n        0x7f56c9471000-0x7f56c9671000   /lib64/libc-2.22.so\r\n        0x7f56c9671000-0x7f56c9675000   /lib64/libc-2.22.so\r\n        0x7f56c9675000-0x7f56c9677000   /lib64/libc-2.22.so\r\n        0x7f56c9677000-0x7f56c967b000\r\n        0x7f56c967b000-0x7f56c9691000   /usr/lib64/gcc/x86_64-pc-linux-gnu/4.9.3/libgcc_s.so.1\r\n        0x7f56c9691000-0x7f56c9890000   /usr/lib64/gcc/x86_64-pc-linux-gnu/4.9.3/libgcc_s.so.1\r\n        0x7f56c9890000-0x7f56c9891000   /usr/lib64/gcc/x86_64-pc-linux-gnu/4.9.3/libgcc_s.so.1\r\n        0x7f56c9891000-0x7f56c9892000   /usr/lib64/gcc/x86_64-pc-linux-gnu/4.9.3/libgcc_s.so.1\r\n        0x7f56c9892000-0x7f56c9898000   /lib64/librt-2.22.so\r\n        0x7f56c9898000-0x7f56c9a98000   /lib64/librt-2.22.so\r\n        0x7f56c9a98000-0x7f56c9a99000   /lib64/librt-2.22.so\r\n        0x7f56c9a99000-0x7f56c9a9a000   /lib64/librt-2.22.so\r\n        0x7f56c9a9a000-0x7f56c9ab1000   /lib64/libpthread-2.22.so\r\n        0x7f56c9ab1000-0x7f56c9cb0000   /lib64/libpthread-2.22.so\r\n        0x7f56c9cb0000-0x7f56c9cb1000   /lib64/libpthread-2.22.so\r\n        0x7f56c9cb1000-0x7f56c9cb2000   /lib64/libpthread-2.22.so\r\n        0x7f56c9cb2000-0x7f56c9cb6000\r\n        0x7f56c9cb6000-0x7f56c9db3000   /lib64/libm-2.22.so\r\n        0x7f56c9db3000-0x7f56c9fb2000   /lib64/libm-2.22.so\r\n        0x7f56c9fb2000-0x7f56c9fb3000   /lib64/libm-2.22.so\r\n        0x7f56c9fb3000-0x7f56c9fb4000   /lib64/libm-2.22.so\r\n        0x7f56c9fb4000-0x7f56c9fb6000   /lib64/libdl-2.22.so\r\n        0x7f56c9fb6000-0x7f56ca1b6000   /lib64/libdl-2.22.so\r\n        0x7f56ca1b6000-0x7f56ca1b7000   /lib64/libdl-2.22.so\r\n        0x7f56ca1b7000-0x7f56ca1b8000   /lib64/libdl-2.22.so\r\n        0x7f56ca1b8000-0x7f56ca67e000   /usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0\r\n        0x7f56ca67e000-0x7f56ca87d000   /usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0\r\n        0x7f56ca87d000-0x7f56ca892000   /usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0\r\n        0x7f56ca892000-0x7f56ca8d4000   /usr/lib64/libMagickWand-7.Q64HDRI.so.0.0.0\r\n        0x7f56ca8d4000-0x7f56cb467000   /usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0\r\n        0x7f56cb467000-0x7f56cb666000   /usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0\r\n        0x7f56cb666000-0x7f56cb69f000   /usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0\r\n        0x7f56cb69f000-0x7f56cb711000   /usr/lib64/libMagickCore-7.Q64HDRI.so.0.0.0\r\n        0x7f56cb711000-0x7f56cb714000\r\n        0x7f56cb714000-0x7f56cb736000   /lib64/ld-2.22.so\r\n        0x7f56cb7f0000-0x7f56cb85c000\r\n        0x7f56cb85c000-0x7f56cb87f000   /usr/share/locale/it/LC_MESSAGES/libc.mo\r\n        0x7f56cb87f000-0x7f56cb928000\r\n        0x7f56cb928000-0x7f56cb935000\r\n        0x7f56cb935000-0x7f56cb936000   /lib64/ld-2.22.so\r\n        0x7f56cb936000-0x7f56cb937000   /lib64/ld-2.22.so\r\n        0x7f56cb937000-0x7f56cb938000\r\n        0x7ffd7df1a000-0x7ffd7df3b000   [stack]\r\n        0x7ffd7dfca000-0x7ffd7dfcc000   [vvar]\r\n        0x7ffd7dfcc000-0x7ffd7dfce000   [vdso]\r\n        0xffffffffff600000-0xffffffffff601000   [vsyscall]\r\n==24975==End of process memory map.\r\n==24975==AddressSanitizer CHECK failed: /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_common.cc:183 \"((0 && \"unable to mmap\")) != (0)\" (0x0, 0x0)\r\n    #0 0x4c9f9d in AsanCheckFailed /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/asan_rtl.cc:67\r\n    #1 0x4d0ad3 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_common.cc:159\r\n    #2 0x4d0cc1 in __sanitizer::ReportMmapFailureAndDie(unsigned long, char const*, char const*, int, bool) /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_common.cc:183\r\n    #3 0x4d9cfa in __sanitizer::MmapOrDie(unsigned long, char const*, bool) /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_posix.cc:122\r\n    #4 0x4244ea in __sanitizer::LargeMmapAllocator<__asan::AsanMapUnmapCallback>::Allocate(__sanitizer::AllocatorStats*, unsigned long, unsigned long) /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_allocator.h:1033\r\n    #5 0x4244ea in __sanitizer::CombinedAllocator<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap<17ul, 128ul, 16ul>, __asan::AsanMapUnmapCallback>, __sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap<17ul, 128ul, 16ul>, __asan::AsanMapUnmapCallback> >, __sanitizer::LargeMmapAllocator<__asan::AsanMapUnmapCallback> >::Allocate(__sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap<17ul, 128ul, 16ul>, __asan::AsanMapUnmapCallback> >*, unsigned long, unsigned long, bool, bool) /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_allocator.h:1302\r\n    #6 0x4244ea in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/asan_allocator.cc:368\r\n    #7 0x41fcdd in __asan::asan_posix_memalign(void**, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*) /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/asan_allocator.cc:751\r\n    #8 0x4c10dd in __interceptor_posix_memalign /var/tmp/portage/sys-devel/llvm-3.8.1-r2/work/llvm-3.8.1.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:126\r\n    #9 0x7f56cae6b334 in AcquireAlignedMemory /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/memory.c:258:7\r\n    #10 0x7f56cae6b334 in AcquireVirtualMemory /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/memory.c:582\r\n    #11 0x7f56bea7af95 in ReadPCXImage /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/coders/pcx.c:400:16\r\n    #12 0x7f56cab3fb12 in ReadImage /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/constitute.c:496:13\r\n    #13 0x7f56cb2d7406 in ReadStream /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/stream.c:1012:9\r\n    #14 0x7f56cab3e5ca in PingImage /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/constitute.c:226:9\r\n    #15 0x7f56cab3ee25 in PingImages /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickCore/constitute.c:326:10\r\n    #16 0x7f56ca3c44c3 in IdentifyImageCommand /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickWand/identify.c:319:18\r\n    #17 0x7f56ca45a26a in MagickCommandGenesis /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/MagickWand/mogrify.c:183:14\r\n    #18 0x4f1fb5 in MagickMain /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/utilities/magick.c:145:10\r\n    #19 0x4f1fb5 in main /tmp/portage/media-gfx/imagemagick-7.0.3.0/work/ImageMagick-7.0.3-0/utilities/magick.c:176\r\n    #20 0x7f56c92fe61f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289\r\n    #21 0x419138 in _init (/usr/bin/magick+0x419138)\r\n```"},"comment":{"url":"https://api.github.com/repos/ImageMagick/ImageMagick/issues/comments/247267318","html_url":"https://github.com/ImageMagick/ImageMagick/issues/267#issuecomment-247267318","issue_url":"https://api.github.com/repos/ImageMagick/ImageMagick/issues/267","id":247267318,"user":{"login":"dlemstra","id":10426229,"avatar_url":"https://avatars.githubusercontent.com/u/10426229?v=3","gravatar_id":"","url":"https://api.github.com/users/dlemstra","html_url":"https://github.com/dlemstra","followers_url":"https://api.github.com/users/dlemstra/followers","following_url":"https://api.github.com/users/dlemstra/following{/other_user}","gists_url":"https://api.github.com/users/dlemstra/gists{/gist_id}","starred_url":"https://api.github.com/users/dlemstra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dlemstra/subscriptions","organizations_url":"https://api.github.com/users/dlemstra/orgs","repos_url":"https://api.github.com/users/dlemstra/repos","events_url":"https://api.github.com/users/dlemstra/events{/privacy}","received_events_url":"https://api.github.com/users/dlemstra/received_events","type":"User","site_admin":false},"created_at":"2016-09-15T08:24:59Z","updated_at":"2016-09-15T08:24:59Z","body":"We want users to be able to allocate an image that uses 64GB of ram. If this causes an issue on your system you should configure the options that are described here: http://www.imagemagick.org/script/security-policy.php. Can you reproduce the issue when you add these limitations?"}}
{"actor":{"display_login":"dlemstra"}}