memory exhausted in ReadSUNImage

[jgj212]

ImageMagick 7.0.7-0 Q16 x86_64

Here is the critical code:

    sun_data=(unsigned char *) AcquireQuantumMemory(sun_info.length,   //line 438
      sizeof(*sun_data));

sun_info.length is from file as follow:

    sun_info.length=ReadBlobMSBLong(image);   //line 312

sun_info.length is 32bit, it can be large as 0xffffffff.
and AcquireQuantumMemory(...) can max use 4G RAM, even if the image file is very small.

Credit: ADLab of Venustech

[mikayla-grace]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ https://www.imagemagick.org/download/beta/ by sometime tomorrow.

1385a09 & 69967f4

[fgeek]

https://nvd.nist.gov/vuln/detail/CVE-2017-14531