Infinite loop inside Exiv2::PsdImage::readMetadata (psdimage.cpp)

[hongxuchen]

There seems an infinite loop inside Exiv2::PsdImage::readMetadata at https://github.com/Exiv2/exiv2/blob/disable-printStructure/src/psdimage.cpp#L200-L233 (5940c6f).

It checks while (resourcesLength > 0) at line 200, resourcesLength is updated at line 232. However sometimes resourceNameLength + resourceSize may be 0xfffffff4, and it will be truncated to 0 when adding 12, making the subtraction to have no effect.

A concrete input is available h01 and h02.

[piponazo]

I have checked the PSD specification and it seems that there is not a maximum value for the "Length of image resource section":

https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/#50577409_pgfId-1037504

Clearly this situations happens because the value of resourcesLength has been intentionally set to have such extreme case value 4194305530.

@D4N In the past you have been dealing with this kind of situations. This is a perfect scenario for using the utility Safe::add, right?

[clanmills]

If the resourceLength is more than file->size(), something smells!

[piponazo]

This issue was fixed by #518

[hongxuchen]

This got assigned CVE-2018-19108.