جزئیات آسیب‌پذیری

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any malformed file), the function throws a `CImgIOException` and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via `load_analyze()` and the generic `load()` when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.

• https://github.com/GreycLab/CImg/security/advisories/GHSA-rmfc-grgj-qwhv x_refsource_CONFIRM
• https://github.com/GreycLab/CImg/commit/6a69bf725ffd111a4c7dc61cc15e3661abd158ee x_refsource_MISC
• https://github.com/GreycLab/CImg/issues/480 x_refsource_MISC