Closed
Description
Version: ImageMagick 7.0.6-2 Q16 x86_64
$magick convert cpu-ReadTXTImage 1.bmp
Here is the critical code
static Image *ReadTXTImage(const ImageInfo *image_info,ExceptionInfo *exception)
{
...
(void) ResetMagickMemory(text,0,sizeof(text));
(void) ReadBlobString(image,text); // text is "MagickID..."
if (LocaleNCompare((char *) text,MagickID,strlen(MagickID)) != 0) // so, cmp==0
ThrowReaderException(CorruptImageError,"ImproperImageHeader");
do
{
...
for (y=0; y < (ssize_t) image->rows; y++)
{
double
alpha,
black,
blue,
green,
red;
red=0.0;
green=0.0;
blue=0.0;
black=0.0;
alpha=0.0;
for (x=0; x < (ssize_t) image->columns; x++)
{
if (ReadBlobString(image,text) == (char *) NULL) // if TXT image is small than 4096 bytes, so, cmp==0 and text is unchanged
break;
...
}
}
(void) ReadBlobString(image,text); // if TXT image is small than 4096 bytes, text is unchanged
if (LocaleNCompare((char *) text,MagickID,strlen(MagickID)) == 0) // so, cmp==0
{
/*
Allocate next image structure.
*/
AcquireNextImage(image_info,image,exception);
if (GetNextImageInList(image) == (Image *) NULL)
{
image=DestroyImageList(image);
return((Image *) NULL);
}
image=SyncNextImageInList(image);
status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
GetBlobSize(image));
if (status == MagickFalse)
break;
}
} while (LocaleNCompare((char *) text,MagickID,strlen(MagickID)) == 0); // so, cmp==0
...
}
If text image file only contains "MagickID..." line, it will cause ReadTXTImage to infinite loop.
testcase: https://github.com/jgj212/poc/blob/master/cpu-ReadTXTImage
Credit: ADLab of Venustech