Skip to content

A possible divide by zero issue found by static analysis #3642

@yiyuaner

Description

@yiyuaner

Prerequisites

  • I have written a descriptive issue title
  • I have searched open and closed issues to ensure it has not already been reported
  • I have verified that I am using the latest version of ImageMagick

ImageMagick version

7.0.11-11

Operating system

Linux

Operating system, version and so on

CentOS

Description

In function OpenPixelCache(Image *image,const MapMode mode, ExceptionInfo *exception), we have the following code:

packet_size=cache_info->number_channels*sizeof(Quantum);
...
columns=(size_t) (length/cache_info->rows/packet_size);

If cache_info->number_channels equals to 0, then we have a divide by zero problem.
Notice that the code explicitly checks the value of cache_info->columns and throws an exception if it is negative:

ImageMagick/MagickCore/cache.c

Lines 3723 to 3725 in 442c87b

if ((cache_info->columns != columns) || ((ssize_t) cache_info->columns < 0) ||
((ssize_t) cache_info->rows < 0))
ThrowBinaryException(ResourceLimitError,"PixelCacheAllocationFailed",

Thus, it seems reasonable to me to also check the value of cache_info->number_channels to avoid any potential problems.

Steps to Reproduce

This is a potential bug found by static analysis, and thus has no POC. Please verify if it is genuine, thanks!

Images

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions