| 标题 | Graphicsmagick 1.3.47 and prior; fixed in development changeset 627b5b1b2fc2 (2026-08-24), not yet in any release Uncontrolled Recursion |
|---|
| 描述 | An unbounded recursion in coders/wpg.c of GraphicsMagick allows a remote attacker to cause a denial of service (stack exhaustion / SIGSEGV) via a crafted WPG file. A WPG record of type 0x11 dispatches to ExtractPostscript(), which sniffs the embedded payload and calls BlobToImage(); because ApproveFormatForWPG() approves the WPG format itself, a WPG file nested inside a WPG file re-enters ReadWPGImage() with no depth limit (~12 KB of stack per level; SIGSEGV after ~640 levels on a default 8 MB stack). The crash is reachable from the gm CLI and from any embedding passing attacker-controlled data to BlobToImage() (the same path as the oss-fuzz coder_WPG_fuzzer harness). The defect was introduced on 2018-03-31 by the change "ExtractPostscript: Allow non-Postscript content" and was verified on 1.3.47 and the 2026-08-13 development tip (plain gcc build, no sanitizer required).Vendor notification and acknowledgement: reported privately to the GraphicsMagick maintainer ([email protected], per www/security.rst) on 2026-08-22. The maintainer replied the same day confirming he had reproduced the problem ("I was able to produce the test case and immediately reproduce the problem"), and fixed it two days later in development changeset 627b5b1b2fc2 (2026-08-24, "Limit recursion under ExtractPostscript() to avoid stack exhaustion given crafted WPG files which are self-referencing"), which caps recursion at 64 levels. No release containing the fix exists yet; 1.3.47 remains the
latest release and is affected. The full email correspondence with the maintainer (report, acknowledgement, and fix commit reference) is available to the VulDB team on request. |
|---|
| 来源 | ⚠️ https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/627b5b1b2fc2 |
|---|
| 用户 | zzxzzb (UID 95450) |
|---|
| 提交 | 2026-09-01 08時17分 (30 日前) |
|---|
| 管理 | 2026-09-30 07時57分 (29 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 411874 [GraphicsMagick 直到 1.3.47 WPG File coders/wpg.c ExtractPostscript 拒绝服务] |
|---|
| 积分 | 20 |
|---|