Memory access bug in string.c

[bernhard]

Hi!

I found a invalid memory access bug detected in the actual SVN-Version of magick/string.c

The memcpy() commands exceeds the length of the source string in CloneString(), AcquireString() and ConstantString().

Code: Select all

<(void) memcpy(destination,source,length*sizeof(*destination));
>(void) memcpy(destination,source,length*sizeof(char));

This results into an access violation running a static linked debug version in VS2010

Anyway, Thanks for your Great Library!
Bernhard

[magick]

The bug you reported only affects CloneString(). There was a missing indirect pointer. Instead of *destination it should be **destination. We have a patch in ImageMagick 6.6.8-8 Beta available by sometime tomorrow. Thanks.