#author("2025-12-11T06:46:02+00:00","default:yoya","yoya")
#author("2025-12-12T16:28:06+00:00","default:yoya","yoya")
[[CVE/ImageMagick]]
32bit 環境だと PSX TIM 画像読み込みで整数オーバーフロー。
- https://www.cve.org/CVERecord?id=CVE-2025-66628
>
In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10.
>
バージョン7.1.2-9およびそれ以前のTIM（PSX TIM）画像パーサーのReadTIMImage関数（coders/tim.c）に、重大な整数オーバーフローの脆弱性が含まれています。このコードは、ファイルヘッダーから幅と高さ（16ビット値）を読み取り、オーバーフローチェックを行わずにimage_size = 2 * width * heightを計算します。32ビットシステム（またはsize_tが32ビット）では、幅と高さが大きい場合（例：65535）、この計算でオーバーフローが発生し、小さな値に折り返されます。その結果、AcquireQuantumMemoryによって小さなヒープ領域が割り当てられ、その後、これらのサイズに依存する操作で境界外読み取りが発生する可能性があります。この問題はバージョン7.1.2-10で修正されています。
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hjr-v6g4-3fm8
* [#o7e3eac5]
- https://www.tenable.com/cve/CVE-2025-66628
>
ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10.
