Closed
Description
Version: ImageMagick 7.0.6-2 Q16 x86_64
#./convert $FILE OUT.png
When convert PDB file , imagemagick will read data from input file and deal with it, here is the critical code:
pdb.c , in function ReadPDBImage:
comment_offset=(ssize_t) ReadBlobMSBSignedLong(image); //365
......
num_pad_bytes = (size_t) (comment_offset - TellBlob( image ));
while (num_pad_bytes--) ReadBlobByte( image ); //574
A crafted file will cause this while loop endless.
testcase: https://github.com/bestshow/p0cs/blob/master/cpupdb.pdb
Credit : ADLab of Venustech