while (EOFBlob(image) != EOF)
{
x=ReadBlobByte(image);
y=ReadBlobByte(image);
if ((x == 0xff) && (y == 0))
break;
if ((x == 254) && (y == 176))
{
/*
Start a new stitch block.
*/
j++;
blocks[j].offset=(ssize_t) i;
if (j >= 256)
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
(void) ReadBlobByte(image);
continue;
}
if ((x & 0x80) == 0)
{
/*
Normal stitch.
*/
if ((x & 0x40) != 0)
x-=0x80;
}
else
{
/*
Jump stitch.
*/
x=((x & 0x0f) << 8)+y;
if ((x & 0x800) != 0)
x-=0x1000;
y=ReadBlobByte(image);
}
if ((y & 0x80) == 0)
{
/*
Normal stitch.
*/
if ((y & 0x40) != 0)
y-=0x80;
}
else
{
/*
Jump stitch.
*/
y=((y & 0x0f) << 8)+ReadBlobByte(image);
if ((y & 0x800) != 0)
y-=0x1000;
}
/*
Note stitch (x,y).
*/
x+=delta_x;
y+=delta_y;
delta_x=x;
delta_y=y;
stitches[i].x=(double) x;
stitches[i].y=(double) y;
if ((double) x < bounds.x1)
bounds.x1=(double) x;
if ((double) x > bounds.x2)
bounds.x2=(double) x;
if ((double) y < bounds.y1)
bounds.y1=(double) y;
if ((double) y > bounds.y2)
bounds.y2=(double) y;
i++;
if (i >= (ssize_t) number_stitches)
{
/*
Make room for more stitches.
*/
number_stitches<<=1;
stitches=(PointInfo *) ResizeQuantumMemory(stitches,(size_t)
number_stitches,sizeof(*stitches));
if (stitches == (PointInfo *) NULL)
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
}
}
in the while loop, only two condition can cause loop exit
'EOFBlob(image) != EOF' is false
this statement will never be false, because EOFBlob(image) must be 0 or 1, never be -1(EOF)
'if ((x == 0xff) && (y == 0))' is true
this statement will never be true, because small crafted file will cause: a) 'x=ReadBlobByte(image);' to set x=-1, and b) 'y=ReadBlobByte(image);' to set y=-1
Version: ImageMagick 7.0.6-1 Q16 x86_64
$magick identify $FILE
Here is the critical code
in the while loop, only two condition can cause loop exit
'EOFBlob(image) != EOF' is false
this statement will never be false, because EOFBlob(image) must be 0 or 1, never be -1(EOF)
'if ((x == 0xff) && (y == 0))' is true
this statement will never be true, because small crafted file will cause: a) 'x=ReadBlobByte(image);' to set x=-1, and b) 'y=ReadBlobByte(image);' to set y=-1
So a crafted will cause endless loop.
testcase:
https://github.com/jgj212/poc/blob/master/cpu-ReadPESImage
Credit: ADLab of Venustech
The text was updated successfully, but these errors were encountered: