### ImageMagick version

7.1.1-32

### Operating system

Linux

### Operating system, version and so on

Ubuntu 20.04.6 LTS

### Description

A stack-buffer-overflow was discovered in MagickCore. The issue is being triggered in function WriteOnePNGImage() at coders/png.c:12176.


### Steps to Reproduce

```
$ export CXX=`which clang++`
$ export CC=`which clang`
$ export CFLAGS='-g -fsanitize=address -O1 -fno-omit-frame-pointer '
$ export CXXFLAGS='-g -fsanitize=address -O1 -fno-omit-frame-pointer '
$ ./configure
$ make
$ ./utilities/.libs/magick  convert stack-buffer-overflow.tiff out.png
=================================================================
==2334505==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffffffe01b0 at pc 0x1555550ee563 bp 0x7ffffffdfa10 sp 0x7ffffffdfa08
WRITE of size 1 at 0x7ffffffe01b0 thread T0
    #0 0x1555550ee562 in WriteOnePNGImage /home/local/asan/ImageMagick/coders/png.c:10121:43
    #1 0x1555550bd224 in WritePNGImage /home/local/asan/ImageMagick/coders/png.c:12176:10
    #2 0x155554c21097 in WriteImage /home/local/asan/ImageMagick/MagickCore/constitute.c:1350:16
    #3 0x155554c21c09 in WriteImages /home/local/asan/ImageMagick/MagickCore/constitute.c:1578:32
    #4 0x1555546b493a in ConvertImageCommand /home/local/asan/ImageMagick/MagickWand/convert.c:3367:30
    #5 0x15555476365e in MagickCommandGenesis /home/local/asan/ImageMagick/MagickWand/magick-cli.c:177:14
    #6 0x4faa8d in MagickMain /home/local/asan/ImageMagick/utilities/magick.c:151:10
    #7 0x4fa788 in main /home/local/asan/ImageMagick/utilities/magick.c:182:10
    #8 0x155553631082 in __libc_start_main /build/glibc-wuryBv/glibc-2.31/csu/../csu/libc-start.c:308:16
    #9 0x41d47d in _start (/home/local/asan/ImageMagick/utilities/.libs/magick+0x41d47d)

Address 0x7ffffffe01b0 is located in stack of thread T0 at offset 304 in frame
    #0 0x1555550dc46f in WriteOnePNGImage /home/local/asan/ImageMagick/coders/png.c:7963

  This frame has 26 object(s):
    [32, 34) 's' (line 7970)
    [48, 304) 'ping_trans_alpha' (line 7986) <== Memory access at offset 304 overflows this variable
    [368, 1139) 'palette' (line 7989)
    [1280, 1290) 'ping_background' (line 7992)
    [1312, 1322) 'ping_trans_color' (line 7992)
    [1344, 1352) 'ping_info' (line 7996)
    [1376, 1384) 'ping' (line 7999)
    [1408, 1416) 'pixel_info' (line 8036)
    [1440, 1456) 'error_info' (line 8042)
    [1472, 1476) 'image_colors' (line 8052)
    [1488, 1492) 'ping_bit_depth' (line 8052)
    [1504, 1508) 'ping_color_type' (line 8052)
    [1520, 1524) 'ping_interlace_method' (line 8052)
    [1536, 1540) 'ping_compression_method' (line 8052)
    [1552, 1556) 'ping_filter_method' (line 8052)
    [1568, 1572) 'ping_num_trans' (line 8052)
    [1584, 1592) 'image_depth' (line 8061)
    [1616, 1624) 'old_bit_depth' (line 8061)
    [1648, 24528) 'opaque' (line 8486)
    [24784, 47664) 'semitransparent' (line 8486)
    [47920, 70800) 'transparent' (line 8486)
    [71056, 93936) 'colormap1444' (line 8781)
    [94192, 94198) 'chunk' (line 10796)
    [94224, 94244) 'chunk4736' (line 10816)
    [94288, 94292) 'chunk5380' (line 11266)
    [94304, 94336) 'chunk5478' (line 11322)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/local/asan/ImageMagick/coders/png.c:10121:43 in WriteOnePNGImage
Shadow bytes around the buggy address:
  0x10007fff3fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff3ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff4010: f1 f1 f1 f1 02 f2 00 00 00 00 00 00 00 00 00 00
  0x10007fff4020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10007fff4030: 00 00 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 00 00
  0x10007fff4040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff4050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff4060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff4070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2334505==ABORTING
```


### Images

[stack-buffer-overflow.zip](https://github.com/ImageMagick/ImageMagick/files/15257186/stack-buffer-overflow.zip)

A stack-buffer-overflow in MagickCore
This is a GitHub Issue
repo:ImageMagick
owner:ImageMagick
Title : A stack-buffer-overflow in MagickCore
Issue date:

--- start body ---
### ImageMagick version

7.1.1-32

### Operating system

Linux

### Operating system, version and so on

Ubuntu 20.04.6 LTS

### Description

A stack-buffer-overflow was discovered in MagickCore. The issue is being triggered in function WriteOnePNGImage() at coders/png.c:12176.


### Steps to Reproduce

```
$ export CXX=`which clang++`
$ export CC=`which clang`
$ export CFLAGS='-g -fsanitize=address -O1 -fno-omit-frame-pointer '
$ export CXXFLAGS='-g -fsanitize=address -O1 -fno-omit-frame-pointer '
$ ./configure
$ make
$ ./utilities/.libs/magick  convert stack-buffer-overflow.tiff out.png
=================================================================
==2334505==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffffffe01b0 at pc 0x1555550ee563 bp 0x7ffffffdfa10 sp 0x7ffffffdfa08
WRITE of size 1 at 0x7ffffffe01b0 thread T0
    #0 0x1555550ee562 in WriteOnePNGImage /home/local/asan/ImageMagick/coders/png.c:10121:43
    #1 0x1555550bd224 in WritePNGImage /home/local/asan/ImageMagick/coders/png.c:12176:10
    #2 0x155554c21097 in WriteImage /home/local/asan/ImageMagick/MagickCore/constitute.c:1350:16
    #3 0x155554c21c09 in WriteImages /home/local/asan/ImageMagick/MagickCore/constitute.c:1578:32
    #4 0x1555546b493a in ConvertImageCommand /home/local/asan/ImageMagick/MagickWand/convert.c:3367:30
    #5 0x15555476365e in MagickCommandGenesis /home/local/asan/ImageMagick/MagickWand/magick-cli.c:177:14
    #6 0x4faa8d in MagickMain /home/local/asan/ImageMagick/utilities/magick.c:151:10
    #7 0x4fa788 in main /home/local/asan/ImageMagick/utilities/magick.c:182:10
    #8 0x155553631082 in __libc_start_main /build/glibc-wuryBv/glibc-2.31/csu/../csu/libc-start.c:308:16
    #9 0x41d47d in _start (/home/local/asan/ImageMagick/utilities/.libs/magick+0x41d47d)

Address 0x7ffffffe01b0 is located in stack of thread T0 at offset 304 in frame
    #0 0x1555550dc46f in WriteOnePNGImage /home/local/asan/ImageMagick/coders/png.c:7963

  This frame has 26 object(s):
    [32, 34) 's' (line 7970)
    [48, 304) 'ping_trans_alpha' (line 7986) <== Memory access at offset 304 overflows this variable
    [368, 1139) 'palette' (line 7989)
    [1280, 1290) 'ping_background' (line 7992)
    [1312, 1322) 'ping_trans_color' (line 7992)
    [1344, 1352) 'ping_info' (line 7996)
    [1376, 1384) 'ping' (line 7999)
    [1408, 1416) 'pixel_info' (line 8036)
    [1440, 1456) 'error_info' (line 8042)
    [1472, 1476) 'image_colors' (line 8052)
    [1488, 1492) 'ping_bit_depth' (line 8052)
    [1504, 1508) 'ping_color_type' (line 8052)
    [1520, 1524) 'ping_interlace_method' (line 8052)
    [1536, 1540) 'ping_compression_method' (line 8052)
    [1552, 1556) 'ping_filter_method' (line 8052)
    [1568, 1572) 'ping_num_trans' (line 8052)
    [1584, 1592) 'image_depth' (line 8061)
    [1616, 1624) 'old_bit_depth' (line 8061)
    [1648, 24528) 'opaque' (line 8486)
    [24784, 47664) 'semitransparent' (line 8486)
    [47920, 70800) 'transparent' (line 8486)
    [71056, 93936) 'colormap1444' (line 8781)
    [94192, 94198) 'chunk' (line 10796)
    [94224, 94244) 'chunk4736' (line 10816)
    [94288, 94292) 'chunk5380' (line 11266)
    [94304, 94336) 'chunk5478' (line 11322)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/local/asan/ImageMagick/coders/png.c:10121:43 in WriteOnePNGImage
Shadow bytes around the buggy address:
  0x10007fff3fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff3ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff4010: f1 f1 f1 f1 02 f2 00 00 00 00 00 00 00 00 00 00
  0x10007fff4020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10007fff4030: 00 00 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 00 00
  0x10007fff4040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff4050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff4060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff4070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2334505==ABORTING
```


### Images

[stack-buffer-overflow.zip](https://github.com/ImageMagick/ImageMagick/files/15257186/stack-buffer-overflow.zip)

--- end body ---

A stack-buffer-overflow vulnerability in the WriteOnePNGImage function of ImageMagick v7.1.1-32 can be exploited to cause a Denial of Service (DoS) or potentially execute arbitrary code. The issue occurs when processing specially crafted TIFF files, leading to a buffer overflow on the stack, which can corrupt memory and crash the application.