limit the number of XCF layers

ImageMagick · Aug 6, 2023 · a4137de · a4137de
1 parent 0682575
commit a4137de
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 7 deletions.
diff --git a/coders/xcf.c b/coders/xcf.c
@@ -1405,13 +1405,17 @@ static Image *ReadXCFImage(const ImageInfo *image_info,ExceptionInfo *exception)
     }
   else
     {
-      int
-        current_layer = 0,
-        foundAllLayers = MagickFalse,
+      MagickBooleanType
+        foundAllLayers = MagickFalse;
+
+      MagickOffsetType
+        oldPos = TellBlob(image);
+
+      size_t
         number_layers = 0;
 
-      MagickOffsetType
-        oldPos=TellBlob(image);
+      ssize_t
+        current_layer = 0;
 
       XCFLayerInfo
         *layer_info;
@@ -1425,7 +1429,12 @@ static Image *ReadXCFImage(const ImageInfo *image_info,ExceptionInfo *exception)
         if (offset == 0)
           foundAllLayers=MagickTrue;
         else
-          number_layers++;
+          {
+            number_layers++;
+            if ((ssize_t) number_layers == SSIZE_MAX)
+              ThrowReaderException(ResourceLimitError,
+                "ListLengthExceedsLimit");
+          }
         if (EOFBlob(image) != MagickFalse)
           {
             ThrowFileException(exception,CorruptImageError,

diff --git a/magick/gem.h b/magick/gem.h
@@ -26,7 +26,7 @@ extern "C" {
 #endif
 
 extern MagickExport double
-  ExpandAffine(const AffineMatrix *),
+  ExpandAffine(const AffineMatrix *) magick_attribute((__pure__)),
   GenerateDifferentialNoise(RandomInfo *,const Quantum,const NoiseType,
     const MagickRealType);