Version: ImageMagick 7.0.6-1 Q16 x86_64
#./magick identify $FILE
When identify SUN file , imagemagick will allocate memory to store the data, here is the critical code:
sun.c , in function ReadSUNImage:
if (AcquireImageColormap(image,image->colors,exception) == MagickFalse) //345
ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
image->colors can be controlled by struct _SUNInfo value "sun_info", and sun_info is read from ReadBlobMSBLong(image) as follow, in other words image->colors can be read from input file.
Version: ImageMagick 7.0.6-1 Q16 x86_64
#./magick identify $FILE
When identify SUN file , imagemagick will allocate memory to store the data, here is the critical code:
sun.c , in function ReadSUNImage:
colormap.c , in function AcquireImageColormap:
memory.c in function AcquireQuantumMemory(const size_t count,const size_t quantum):
AcquireMagickMemory is the same to malloc.
image->colors can be controlled by struct _SUNInfo value "sun_info", and sun_info is read from ReadBlobMSBLong(image) as follow, in other words image->colors can be read from input file.
Here is my policy.xml to limit memory usage,but 256MB limit can be bypassed.
testcase: https://github.com/bestshow/p0cs/blob/master/memory_exhaustion_in_ReadSUNImage
Credit: ADLab of Venustech
The text was updated successfully, but these errors were encountered: