Headline
CVE-2020-27560: There is a Division by Zero in function OptimizeLayerFrames (#2743) · ImageMagick/ImageMagick@ef59bd7
ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
@@ -1352,11 +1352,13 @@ static Image *OptimizeLayerFrames(const Image *image,const LayerMethod method,
if ( disposals[i] == DelDispose ) {
size_t time = 0;
while ( disposals[i] == DelDispose ) {
time += curr->delay*1000/curr->ticks_per_second;
time +=(size_t) (curr->delay*1000*
PerceptibleReciprocal((double) curr->ticks_per_second));
curr=GetNextImageInList(curr);
i++;
}
time += curr->delay*1000/curr->ticks_per_second;
time += (size_t)(curr->delay*1000*
PerceptibleReciprocal((double) curr->ticks_per_second));
prev_image->ticks_per_second = 100L;
prev_image->delay = time*prev_image->ticks_per_second/1000;
}
Related news
Ubuntu Security Notice 7068-1 - It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into processing a specially crafted file, an attacker could exploit this to cause a denial of service or affect the reliability of the system. The vulnerabilities included memory leaks, buffer overflows, and improper handling of pixel data.