This issue is fixed by Mercurial commit 18143:8d4bbb4eb1b9. There was
some wrong code in tiff.c which did not match other similar code.
However, I am not sure why the blob I/O code became more fragile given
misuse due to the changeset I mentioned earlier.
There needs to be another GM release soon give that at five security
issues have been addressed since the last release.
Bob
On 8/29/26 10:11, Alexis Bienvenüe wrote:
Package: graphicsmagick
Version: 1.4+really1.3.48-1
Severity: normal
Tags: upstream
Dear Maintainer,
The GraphicsMagick command fails when decomposing a (three or more) multiple
frames tiff image to multiple tiff images. For example:
gm convert -size 10x10xc:black image1.tif
gm convert image1.tif image1.tif image1.tif image.tif
gm identify image.tif
gm convert image.tif +adjoin image_%04d.tif
leads to the output:
image.tif[0] TIFF 10x10+0+0 DirectClass 1-bit 860 0.000u 0m:0.000005s
image.tif[1] TIFF 10x10+0+0 DirectClass 1-bit 860 0.000u 0m:0.000039s
image.tif[2] TIFF 10x10+0+0 DirectClass 1-bit 860 0.000u 0m:0.000033s
double free or corruption (out)
gm convert: abort due to signal 6 (SIGABRT) "Abort"...
Aborted
even if the output images image_0000.tif, image_0001.tif and image_0002.tif are
properly generated.
This runs with no error when image.tif contains only two frames, and when
requesting a jpg output image_%04d.jpg
These commands run with no error with version
libgraphicsmagick-q16-3t64=1.4+really1.3.45+hg17696-1
Thanks,
Alexis Bienvenüe.
-- System Information:
Debian Release: forky/sid
APT prefers testing
APT policy: (1200, 'testing'), (1000, 'stable'), (200, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 7.1.8+deb14.1-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_WARN
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages graphicsmagick depends on:
ii libc6 2.43-3
ii libgraphicsmagick-q16-3t64 1.4+really1.3.48-1
graphicsmagick recommends no packages.
Versions of packages graphicsmagick suggests:
pn graphicsmagick-dbg <none>
-- no debconf information
