CVE-2022-0284: 
ImageMagick vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability was discovered in ImageMagick version 7.1.0-20, specifically in the GetPixelAlpha() function declared in MagickCore/pixel-accessor.h. The vulnerability is triggered when processing a specially crafted Tagged Image File Format (TIFF) image during conversion to PICON file format (GitHub Issue, RedHat Bugzilla).

The vulnerability manifests as a heap buffer overflow during the GetPixelAlpha() function execution. The issue occurs specifically when converting TIFF images to PICON format, where the code incorrectly references the source image instead of the destination image for alpha channel operations. The bug was identified using Address Sanitizer (ASAN) which detected a READ overflow of size 4 bytes beyond an allocated memory region (GitHub Issue).

The exploitation of this vulnerability could potentially lead to denial of service conditions or information leaks when processing specially crafted TIFF images (RedHat Bugzilla).

A proof of concept exists demonstrating the vulnerability through the conversion of a specially crafted TIFF file to PICON format using the ImageMagick convert utility. The issue can be reproduced by compiling ImageMagick with Address Sanitizer and attempting to convert a malicious TIFF file (GitHub Issue).

The vulnerability was fixed in a patch that corrected the image reference in the GetPixelAlpha() function calls. The fix involved changing the source of the alpha channel check from 'image' to 'picon' in the affected code sections (GitHub Commit).