Practically-infinite loop in MagickCore/image.c - SetImageBackgroundColor

[Moshe Kaplan]

SetImageBackgroundColor contains the following loop:

for (y=0; y < (ssize_t) image->rows; y++)
  {
    register Quantum
      *restrict q;

    register ssize_t
      x;

    if (status == MagickFalse)
      continue;
    q=QueueCacheViewAuthenticPixels(image_view,0,y,image->columns,1,exception);
    if (q == (Quantum *) NULL)
      {
        status=MagickFalse;
        continue;
      }
    for (x=0; x < (ssize_t) image->columns; x++)
    {
      SetPixelViaPixelInfo(image,&background,q);
      q+=GetPixelChannels(image);
    }
    if (SyncCacheViewAuthenticPixels(image_view,exception) == MagickFalse)
      status=MagickFalse;
  }

this means it can execute the inner loop 2^31 times for each valid row, for a potential maximum of 2^62 iterations.

[Moshe Kaplan (moshekaplan)]

https://github.com/ImageMagick/ImageMagick/issues/27