ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
FB264CB7-AFF2-45C4-A12E-9C65BD7DDD76
6.9.10-55
cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*
6B173DFB-D070-44D6-BE3F-772BF990E3A9
7.0.8-55
7.0.0-0
OR
### Prerequisites

- [x] I have written a descriptive issue title
- [x] I have verified that I am using the latest version of ImageMagick
- [x] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There's a heap-buffer-overflow at MagickCore/string.c:853 in DestroyStringInfo.

### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
[poc](https://github.com/007Alice/crashes/raw/master/ImageMagick_crash_0)
run command:
./magick convert poc /dev/null
```
==29840==ERROR: AddressSanitizer: heap-use-after-free on address 0x60400000af68 at pc 0x7f9e79581fab bp 0x7fff303409f0 sp 0x7fff303409e0
READ of size 8 at 0x60400000af68 thread T0
    #0 0x7f9e79581faa in DestroyStringInfo MagickCore/string.c:853
    #1 0x7f9e7985ebaf in ReadJPEGImage coders/jpeg.c:1198
    #2 0x7f9e7929dbba in ReadImage MagickCore/constitute.c:547
    #3 0x7f9e7929fde0 in ReadImages MagickCore/constitute.c:917
    #4 0x7f9e78aab965 in ConvertImageCommand MagickWand/convert.c:617
    #5 0x7f9e78c3d9a6 in MagickCommandGenesis MagickWand/mogrify.c:185
    #6 0x4017d1 in MagickMain utilities/magick.c:149
    #7 0x4019b2 in main utilities/magick.c:180
    #8 0x7f9e783c982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x4012e8 in _start (/home/ImageMagick/utilities/.libs/lt-magick+0x4012e8)

0x60400000af68 is located 24 bytes inside of 40-byte region [0x60400000af50,0x60400000af78)
freed by thread T0 here:
    #0 0x7f9e79ed42ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
    #1 0x7f9e7945cfac in RelinquishMagickMemory MagickCore/memory.c:1074
    #2 0x7f9e7958216e in DestroyStringInfo MagickCore/string.c:862
    #3 0x7f9e7985b93c in ReadICCProfile coders/jpeg.c:570
    #4 0x7f9e77373954  (/usr/lib/x86_64-linux-gnu/libjpeg.so.8+0x20954)

previously allocated by thread T0 here:
    #0 0x7f9e79ed4602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x7f9e7945c056 in AcquireMagickMemory MagickCore/memory.c:478
    #2 0x7f9e7957fb60 in AcquireCriticalMemory MagickCore/memory-private.h:64
    #3 0x7f9e7957ff57 in AcquireStringInfoContainer MagickCore/string.c:181
    #4 0x7f9e7958029d in BlobToStringInfo MagickCore/string.c:236
    #5 0x7f9e7985b7ec in ReadICCProfile coders/jpeg.c:549
    #6 0x7f9e77373954  (/usr/lib/x86_64-linux-gnu/libjpeg.so.8+0x20954)

SUMMARY: AddressSanitizer: heap-use-after-free MagickCore/string.c:853 DestroyStringInfo
Shadow bytes around the buggy address:
  0x0c087fff9590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c087fff95e0: fa fa fa fa fa fa fa fa fa fa fd fd fd[fd]fd fa
  0x0c087fff95f0: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fa
  0x0c087fff9600: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
  0x0c087fff9610: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05

SUMMARY: AddressSanitizer: heap-use-after-free MagickCore/string.c:853 DestroyStringInfo
Shadow bytes around the buggy address:
  0x0c087fff9590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c087fff95e0: fa fa fa fa fa fa fa fa fa fa fd fd fd[fd]fd fa
  0x0c087fff95f0: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fa
  0x0c087fff9600: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
  0x0c087fff9610: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
    #4 0x7f9e78aab965 in ConvertImageCommand MagickWand/convert.c:617
    #5 0x7f9e78c3d9a6 in MagickCommandGenesis MagickWand/mogrify.c:185
    #6 0x4017d1 in MagickMain utilities/magick.c:149
    #7 0x4019b2 in main utilities/magick.c:180
    #8 0x7f9e783c982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x4012e8 in _start (/home/ImageMagick/utilities/.libs/lt-magick+0x4012e8)

0x60400000af68 is located 24 bytes inside of 40-byte region [0x60400000af50,0x60400000af78)
freed by thread T0 here:
    #0 0x7f9e79ed42ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
    #1 0x7f9e7945cfac in RelinquishMagickMemory MagickCore/memory.c:1074
    #2 0x7f9e7958216e in DestroyStringInfo MagickCore/string.c:862
    #3 0x7f9e7985b93c in ReadICCProfile coders/jpeg.c:570
    #4 0x7f9e77373954  (/usr/lib/x86_64-linux-gnu/libjpeg.so.8+0x20954)

previously allocated by thread T0 here:
    #0 0x7f9e79ed4602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x7f9e7945c056 in AcquireMagickMemory MagickCore/memory.c:478
    #2 0x7f9e7957fb60 in AcquireCriticalMemory MagickCore/memory-private.h:64
    #3 0x7f9e7957ff57 in AcquireStringInfoContainer MagickCore/string.c:181
    #4 0x7f9e7958029d in BlobToStringInfo MagickCore/string.c:236
    #5 0x7f9e7985b7ec in ReadICCProfile coders/jpeg.c:549
    #6 0x7f9e77373954  (/usr/lib/x86_64-linux-gnu/libjpeg.so.8+0x20954)

SUMMARY: AddressSanitizer: heap-use-after-free MagickCore/string.c:853 DestroyStringInfo
Shadow bytes around the buggy address:
  0x0c087fff9590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c087fff95e0: fa fa fa fa fa fa fa fa fa fa fd fd fd[fd]fd fa
  0x0c087fff95f0: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fa
  0x0c087fff9600: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
  0x0c087fff9610: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
  0x0c087fff9620: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 fa
  0x0c087fff9630: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==29840==ABORTING
```
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
Version: ImageMagick 7.0.8-54 Q16 x86_64 2019-07-18 https://imagemagick.org
Copyright: © 1999-2019 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP(4.0) 
Delegates (built-in): bzlib djvu fftw fontconfig freetype gvc jbig jng jpeg lcms lqr lzma openexr pangocairo png tiff webp wmf x xml zlib

- Environment (Operating system, version and so on):
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.6 LTS
Release:        16.04
Codename:       xenial

- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->

heap-buffer-overflow at MagickCore/string.c:853 in DestroyStringInfo
This is a GitHub Issue
repo:ImageMagick
owner:ImageMagick
Title : heap-buffer-overflow at MagickCore/string.c:853 in DestroyStringInfo
Issue date:

--- start body ---
### Prerequisites

- [x] I have written a descriptive issue title
- [x] I have verified that I am using the latest version of ImageMagick
- [x] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There's a heap-buffer-overflow at MagickCore/string.c:853 in DestroyStringInfo.

### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
[poc](https://github.com/007Alice/crashes/raw/master/ImageMagick_crash_0)
run command:
./magick convert poc /dev/null
```
==29840==ERROR: AddressSanitizer: heap-use-after-free on address 0x60400000af68 at pc 0x7f9e79581fab bp 0x7fff303409f0 sp 0x7fff303409e0
READ of size 8 at 0x60400000af68 thread T0
    #0 0x7f9e79581faa in DestroyStringInfo MagickCore/string.c:853
    #1 0x7f9e7985ebaf in ReadJPEGImage coders/jpeg.c:1198
    #2 0x7f9e7929dbba in ReadImage MagickCore/constitute.c:547
    #3 0x7f9e7929fde0 in ReadImages MagickCore/constitute.c:917
    #4 0x7f9e78aab965 in ConvertImageCommand MagickWand/convert.c:617
    #5 0x7f9e78c3d9a6 in MagickCommandGenesis MagickWand/mogrify.c:185
    #6 0x4017d1 in MagickMain utilities/magick.c:149
    #7 0x4019b2 in main utilities/magick.c:180
    #8 0x7f9e783c982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x4012e8 in _start (/home/ImageMagick/utilities/.libs/lt-magick+0x4012e8)

0x60400000af68 is located 24 bytes inside of 40-byte region [0x60400000af50,0x60400000af78)
freed by thread T0 here:
    #0 0x7f9e79ed42ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
    #1 0x7f9e7945cfac in RelinquishMagickMemory MagickCore/memory.c:1074
    #2 0x7f9e7958216e in DestroyStringInfo MagickCore/string.c:862
    #3 0x7f9e7985b93c in ReadICCProfile coders/jpeg.c:570
    #4 0x7f9e77373954  (/usr/lib/x86_64-linux-gnu/libjpeg.so.8+0x20954)

previously allocated by thread T0 here:
    #0 0x7f9e79ed4602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x7f9e7945c056 in AcquireMagickMemory MagickCore/memory.c:478
    #2 0x7f9e7957fb60 in AcquireCriticalMemory MagickCore/memory-private.h:64
    #3 0x7f9e7957ff57 in AcquireStringInfoContainer MagickCore/string.c:181
    #4 0x7f9e7958029d in BlobToStringInfo MagickCore/string.c:236
    #5 0x7f9e7985b7ec in ReadICCProfile coders/jpeg.c:549
    #6 0x7f9e77373954  (/usr/lib/x86_64-linux-gnu/libjpeg.so.8+0x20954)

SUMMARY: AddressSanitizer: heap-use-after-free MagickCore/string.c:853 DestroyStringInfo
Shadow bytes around the buggy address:
  0x0c087fff9590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c087fff95e0: fa fa fa fa fa fa fa fa fa fa fd fd fd[fd]fd fa
  0x0c087fff95f0: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fa
  0x0c087fff9600: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
  0x0c087fff9610: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05

SUMMARY: AddressSanitizer: heap-use-after-free MagickCore/string.c:853 DestroyStringInfo
Shadow bytes around the buggy address:
  0x0c087fff9590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c087fff95e0: fa fa fa fa fa fa fa fa fa fa fd fd fd[fd]fd fa
  0x0c087fff95f0: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fa
  0x0c087fff9600: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
  0x0c087fff9610: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
    #4 0x7f9e78aab965 in ConvertImageCommand MagickWand/convert.c:617
    #5 0x7f9e78c3d9a6 in MagickCommandGenesis MagickWand/mogrify.c:185
    #6 0x4017d1 in MagickMain utilities/magick.c:149
    #7 0x4019b2 in main utilities/magick.c:180
    #8 0x7f9e783c982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x4012e8 in _start (/home/ImageMagick/utilities/.libs/lt-magick+0x4012e8)

0x60400000af68 is located 24 bytes inside of 40-byte region [0x60400000af50,0x60400000af78)
freed by thread T0 here:
    #0 0x7f9e79ed42ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
    #1 0x7f9e7945cfac in RelinquishMagickMemory MagickCore/memory.c:1074
    #2 0x7f9e7958216e in DestroyStringInfo MagickCore/string.c:862
    #3 0x7f9e7985b93c in ReadICCProfile coders/jpeg.c:570
    #4 0x7f9e77373954  (/usr/lib/x86_64-linux-gnu/libjpeg.so.8+0x20954)

previously allocated by thread T0 here:
    #0 0x7f9e79ed4602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x7f9e7945c056 in AcquireMagickMemory MagickCore/memory.c:478
    #2 0x7f9e7957fb60 in AcquireCriticalMemory MagickCore/memory-private.h:64
    #3 0x7f9e7957ff57 in AcquireStringInfoContainer MagickCore/string.c:181
    #4 0x7f9e7958029d in BlobToStringInfo MagickCore/string.c:236
    #5 0x7f9e7985b7ec in ReadICCProfile coders/jpeg.c:549
    #6 0x7f9e77373954  (/usr/lib/x86_64-linux-gnu/libjpeg.so.8+0x20954)

SUMMARY: AddressSanitizer: heap-use-after-free MagickCore/string.c:853 DestroyStringInfo
Shadow bytes around the buggy address:
  0x0c087fff9590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff95d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c087fff95e0: fa fa fa fa fa fa fa fa fa fa fd fd fd[fd]fd fa
  0x0c087fff95f0: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fa
  0x0c087fff9600: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
  0x0c087fff9610: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 05
  0x0c087fff9620: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 00 fa
  0x0c087fff9630: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==29840==ABORTING
```
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
Version: ImageMagick 7.0.8-54 Q16 x86_64 2019-07-18 https://imagemagick.org
Copyright: © 1999-2019 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP(4.0) 
Delegates (built-in): bzlib djvu fftw fontconfig freetype gvc jbig jng jpeg lcms lqr lzma openexr pangocairo png tiff webp wmf x xml zlib

- Environment (Operating system, version and so on):
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.6 LTS
Release:        16.04
Codename:       xenial

- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->

--- end body ---

comments :
--- start comments ---

--- end comments ---