On: Remote code execution vulnerability in ImageMagick

[rmdoss]

Hard problem now: Find all places where ImageMagick is being used and no one knows about.

[kodfodrasz → rmdoss]

Given pain to set up ImageMagick it probably cannot go unnoticed anywhere. Tried to use that crap as a library not so lately, but it gave me brain cancer. I sticked to libgd finally, as that is a library, no setup to /bin, /etc, or on Windows to C:\Progra~1, and the library entry points of GD don't look as if designed by an oh-so-funny idiot on the spectrum.

http://www.imagemagick.org/script/magick-wand.php

MagickWandGenesis(); contrast_wand=NewMagickWand(); status=MagickReadImage(contrast_wand,argv[1]);

Tell me please, that this is a sane API, but then please provide me your github account as well, just to know what to avoid at all costs in the future

Edit: USE LIBGD: http://libgd.github.io/ it has friendly API, suggesting sane developers, and the API is easy to use from wrappers (I used with P/Invoke interop from C# without any hickups). It looks to me that it was designed in a way to be easily usable that way, which suggests design, not just growing code like cancer.

[crb002 → rmdoss]

That's easy. Replacing all the hoards of other handwritten input parsers with formal parsers is the task at hand.

The new bounty will be for proofs of input parser correctness, not exploits.