Closed
Description
ImageMagick 7.0.7-0 Q16 x86_64
Here is the critical code:
sun_data=(unsigned char *) AcquireQuantumMemory(sun_info.length, //line 438
sizeof(*sun_data));
sun_info.length is from file as follow:
sun_info.length=ReadBlobMSBLong(image); //line 312
sun_info.length is 32bit, it can be large as 0xffffffff.
and AcquireQuantumMemory(...) can max use 4G RAM, even if the image file is very small.
Credit: ADLab of Venustech