dpx.file.image_offset=ReadBlobLong(image); //dpx.c line 723
for ( ; offset < (MagickOffsetType) dpx.file.image_offset; offset++) //dpx.c line 1119
(void) ReadBlobByte(image);
Because dpx.file.image_offset is a unsigned int, it can be controlled as large as 4294967295.
This will cause ImageMagick spend a lot of time to process a crafted DPX imagefile, even if the imagefile is very small.
Credit: ADLab of Venustech
The text was updated successfully, but these errors were encountered:
Version: ImageMagick 7.0.6-0 Q16 x86_64
$magick identify $FILE
Because dpx.file.image_offset is a unsigned int, it can be controlled as large as 4294967295.
This will cause ImageMagick spend a lot of time to process a crafted DPX imagefile, even if the imagefile is very small.
Credit: ADLab of Venustech
The text was updated successfully, but these errors were encountered: