Skip to content

endless loop in ReadTXTImage #591

Closed
Closed
@jgj212

Description

@jgj212

Version: ImageMagick 7.0.6-2 Q16 x86_64

$magick convert cpu-ReadTXTImage 1.bmp

Here is the critical code

static Image *ReadTXTImage(const ImageInfo *image_info,ExceptionInfo *exception)
{
	...
	(void) ResetMagickMemory(text,0,sizeof(text));
	(void) ReadBlobString(image,text);  // text is "MagickID..."
	if (LocaleNCompare((char *) text,MagickID,strlen(MagickID)) != 0)  // so, cmp==0
		ThrowReaderException(CorruptImageError,"ImproperImageHeader");
	do
  	{
  		...
        for (y=0; y < (ssize_t) image->rows; y++)
	    {
	      double
	        alpha,
	        black,
	        blue,
	        green,
	        red;

	      red=0.0;
	      green=0.0;
	      blue=0.0;
	      black=0.0;
	      alpha=0.0;
	      for (x=0; x < (ssize_t) image->columns; x++)
	      {
	        if (ReadBlobString(image,text) == (char *) NULL) // if TXT image is small than 4096 bytes, so, cmp==0 and text is unchanged
	          break;
	        ...
	  	  }
	  	}
	  	(void) ReadBlobString(image,text); // if TXT image is small than 4096 bytes, text is unchanged
	    if (LocaleNCompare((char *) text,MagickID,strlen(MagickID)) == 0) // so, cmp==0
	      {
	        /*
	          Allocate next image structure.
	        */
	        AcquireNextImage(image_info,image,exception);
	        if (GetNextImageInList(image) == (Image *) NULL)
	          {
	            image=DestroyImageList(image);
	            return((Image *) NULL);
	          }
	        image=SyncNextImageInList(image);
	        status=SetImageProgress(image,LoadImagesTag,TellBlob(image),
	          GetBlobSize(image));
	        if (status == MagickFalse)
	          break;
	      }
	  } while (LocaleNCompare((char *) text,MagickID,strlen(MagickID)) == 0); // so, cmp==0
	  ...
}

If text image file only contains "MagickID..." line, it will cause ReadTXTImage to infinite loop.

testcase: https://github.com/jgj212/poc/blob/master/cpu-ReadTXTImage

Credit: ADLab of Venustech

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions