CVE-2022-0284: 
ImageMagick vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability was discovered in ImageMagick version 7.1.0-20, specifically in the GetPixelAlpha() function declared in MagickCore/pixel-accessor.h. The vulnerability is triggered when processing a specially crafted Tagged Image File Format (TIFF) image during conversion to PICON file format (GitHub Issue, RedHat Bugzilla).

The vulnerability manifests as a heap buffer overflow during the GetPixelAlpha() function execution. The issue occurs specifically when converting TIFF images to PICON format, where the code incorrectly references the source image instead of the destination image for alpha channel operations. The bug was identified using Address Sanitizer (ASAN) which detected a READ overflow of size 4 bytes beyond an allocated memory region (GitHub Issue).

The exploitation of this vulnerability could potentially lead to denial of service conditions or information leaks when processing specially crafted TIFF images (RedHat Bugzilla).

The vulnerability was fixed in a patch that corrected the image reference in the GetPixelAlpha() function calls. The fix involved changing the source of the alpha channel check from 'image' to 'picon' in the affected code sections (GitHub Commit).