ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop

Summary SixLabors.ImageSharp 4.1.1 can spend an attacker-controlled duration decoding a small malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader iterates once per declared entry, but when fewer than 20 bytes remain for an entry, the entry read returns without advancing. A...

GHSA-WMXV-XPHR-5C9G ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop

Summary SixLabors.ImageSharp 4.1.1 can spend an attacker-controlled duration decoding a small malformed BigTIFF. The BigTIFF IFD entry-count field is 64-bit. The reader iterates once per declared entry, but when fewer than 20 bytes remain for an entry, the entry read returns without advancing. A...