Crash in ReadJPEGImage on invalid 8BIM-Profile

[egb]

When opening an image containing an invalid Photoshop 8BIM / IPTC block (looks like the length is invalid), the JPEG-Decoder crashes in ReadIPTCProfile.

Backtrace:

Code: Select all

#0  0x000000320072adc7 in CopyMagickMemory (destination=0x7f8c4dffe010, source=0x198661c, size=704644702) at magick/memory.c:457
#1  0x000000320078d706 in SetStringInfoDatum (string_info=0x1f688b0, source=0x198661c "\034\001Z") at magick/string.c:1660      
#2  0x00000032007490c2 in GetProfilesFromResourceBlock (image=0x1e8e3f0, resource_block=0x1dfd580) at magick/profile.c:1341     
#3  0x000000320074958c in SetImageProfile (image=0x1e8e3f0, name=0x7f8c8ef94ccb "8bim", profile=0x1dfd580) at magick/profile.c:1454
#4  0x00007f8c8ef8fe5d in ReadIPTCProfile (jpeg_info=0x48212850) at coders/jpeg.c:500                                              
#5  0x000000313ce10c11 in ?? () from /usr/lib/libjpeg.so.62                                                                        
#6  0x000000313ce0e9bf in ?? () from /usr/lib/libjpeg.so.62                                                                        
#7  0x000000313ce0cf52 in jpeg_consume_input () from /usr/lib/libjpeg.so.62                                                        
#8  0x000000313ce0d313 in jpeg_read_header () from /usr/lib/libjpeg.so.62                                                          
#9  0x00007f8c8ef90757 in ReadJPEGImage (image_info=0x1a011f0, exception=0x48218e40) at coders/jpeg.c:742                          
#10 0x0000003200679ce6 in ReadImage (image_info=0x1dc2b50, exception=0x48218e40) at magick/constitute.c:516                        
#11 0x0000003200643632 in BlobToImage (image_info=0x1dc73c0, blob=0x1f578a0, length=62282, exception=0x48218e40) at magick/blob.c:358
#12 0x00007f8c8f1f7135 in Magick::Image::read () from /usr/lib/libMagick++.so.2                                                      
#13 0x00007f8c8f1f75fb in Magick::Image::Image () from /usr/lib/libMagick++.so.2                                                     

You can download an example image here:

http://www.xebec.de/magick/crash_8bim.jpg

using identify -verbose on the file produces the same crash.

Version I'm using is:
Version: ImageMagick 6.5.0-1 2009-03-18 Q16 http://www.imagemagick.org
(With some little patches to wand.c )

[magick]

We have a patch for the problem you reported. Look for it in the Subversion trunk by sometime tomorrow. Thanks.