ImageMagick Convert Tiff Adobe Deflate 任意代码执行漏洞（CVE-2016-8707）

This vulnerability is present in the convert utility bundled with ImageMagick. Thus utility is used by many web applications to parse and convert images and other formats inter changeably. It is a very popular piece of software for this use. The vulnerability arises when attempting to deflate an Adobe Deflate compressed Tiff image. The vulnerability arises in the way that ImageMagick handles compressed data inside of an image. The size necessary to hold the decompressed data is calculated and then passed in to LibTiff but it is not large enough to hold the decompressed stream. The buffer is calculated here: ``` pixels=(unsigned char *) GetQuantumPixels(quantum_info); ``` and then passed in here as op: ``` static int ZIPDecode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s) { ``` Finally this buffer is used as the next available buffer in a stream which has more data than is available and the out of bounds write occurs. ``` sp->stream.next_out = op; ... int state = inflate(&sp->stream, Z_PARTIAL_FLUSH); ``` This is a controlled out of bounds write that under proper circumstances could be exploited into full remote code execution. #### CRASH INFORMATION ``` Crashed thread log = : Dispatch queue: com.apple.main-thread frame #0: 0x00007fff9563d9c2 libz.1.dylib`inflate + 2549 frame #1: 0x0000000100fec96a libtiff.5.dylib`ZIPDecode(tif=0x0000000103bf9bb0, op=<unavailable>, occ=<unavailable>,s=<unavailable>) + 186 at tif_zip.c:185 frame #2: 0x0000000100fe89d5 libtiff.5.dylib`TIFFReadScanline(tif=0x0000000103bf9bb0, buf=0x0000000105114ef0, row=0, sample=0) + 693 at tif_read.c:299 frame #3: 0x0000000100979499 libMagickCore-7.Q16HDRI.0.dylib`ReadTIFFImage [inlined] TIFFReadPixels(bits_per_sample=0) + 27993 at tiff.c:873 frame #4: 0x000000010097948b libMagickCore-7.Q16HDRI.0.dylib`ReadTIFFImage(image_info=0x0000000101cb8de0, exception=0x0000000101b4bfc0) + 27979 at tiff.c:1708 frame #5: 0x00000001000f69e8 libMagickCore-7.Q16HDRI.0.dylib`ReadImage(image_info=0x0000000101c61de0, exception=0x0000000101b4bfc0) + 3720 at constitute.c:554 frame #6: 0x00000001000f9557 libMagickCore-7.Q16HDRI.0.dylib`ReadImages(image_info=0x0000000101bd4de0, filename="crash1.tif", exception=0x0000000101b4bfc0) + 1447 --- exception=EXC_BAD_ACCESS:signal=11:is_exploitable=yes:instruction_disassembly=.byte 0xc5 #bad opcode:instruction_address=0x00007fff8b1b303b:access_type=unknown:access_address=0x000000010985b000: Crash accessing invalid address. Consider running it again with libgmalloc(3) to see if the log changes. ``` #### CREDIT Discovered by Tyler Bohan of Cisco Talos ####TIMELINE 2016-10-10 - Vendor Disclosure 2016-12-03 - Public Release