Browse Source

Prevent crafted DOS attack.

pull/2501/head
James Jackson-South 3 years ago
parent
commit
ef5fe795d0
  1. 2
      src/ImageSharp/Formats/Pbm/BufferedReadStreamExtensions.cs
  2. 11
      tests/ImageSharp.Tests/Formats/Pbm/PbmMetadataTests.cs

2
src/ImageSharp/Formats/Pbm/BufferedReadStreamExtensions.cs

@ -28,7 +28,7 @@ internal static class BufferedReadStreamExtensions
{
innerValue = stream.ReadByte();
}
while (innerValue != 0x0a);
while (innerValue is not 0x0a and not -0x1);
// Continue searching for whitespace.
val = innerValue;

11
tests/ImageSharp.Tests/Formats/Pbm/PbmMetadataTests.cs

@ -1,6 +1,7 @@
// Copyright (c) Six Labors.
// Licensed under the Six Labors Split License.
using SixLabors.ImageSharp.Formats;
using SixLabors.ImageSharp.Formats.Pbm;
using static SixLabors.ImageSharp.Tests.TestImages.Pbm;
@ -80,4 +81,14 @@ public class PbmMetadataTests
Assert.NotNull(bitmapMetadata);
Assert.Equal(expectedComponentType, bitmapMetadata.ComponentType);
}
[Fact]
public void Identify_HandlesCraftedDenialOfServiceString()
{
byte[] bytes = Convert.FromBase64String("UDEjWAAACQAAAAA=");
ImageInfo info = Image.Identify(bytes);
Assert.Equal(default, info.Size);
Configuration.Default.ImageFormatsManager.TryFindFormatByFileExtension("pbm", out IImageFormat format);
Assert.Equal(format!, info.Metadata.DecodedImageFormat);
}
}

Loading…
Cancel
Save