ImageMagick policy.xml unterminated DOCTYPE parsing exception

Vulnerability Overview This vulnerability involves a parsing issue with the file in the ImageMagick library. Specifically, when parsing the file, an unterminated DOCTYPE declaration causes the program to throw an exception and return an error. Affected Scope Affected Versions: ImageMagick 6.9.13-57 and earlier. Affected Component: The function in the file. Remediation Fix Commit: Fix Content: Added a check for unterminated DOCTYPE declarations within the function. If such a condition is detected, an exception is thrown and an error is returned. POC Code The following is a comparison of the code before and after the fix, illustrating the specific remediation details: Before Fix ```c static MagickBooleanType LoadPolicyCacheLinkedInfo(const char cache, const char xml, const char filename, const size_t depth, ExceptionInfo exception) { (void) CopyMagickString(keyword, token, MagickPathExtent); if (LocaleCompare(keyword, "") != 0) && (q != '\0')) (void) GetNextToken(q, &q, token); while (q != '\0') { if (quote != '\0') { if (q == quote) quote = '\0'; q++; continue; } if ((q == '\\') { quote = q; q++; continue; } if (q == '[') { subset_depth++; q++; continue; } if ((q == ']') && (subset_depth > 0)) { subset_depth--; q++; continue; } if ((q == '>') && (subset_depth == 0)) { q++; break; } q++; if (q == '\0') { ThrowMagickException(exception, GetMagickModule(), ConfigureError, "UnterminatedDOCTYPE", "%s", filename); policy_cache_destroy_linked_list(policy_cache, DestroyPolicyElement); return(MagickFalse); } } } if (LocaleCompare(keyword, "") == 0) { q += 3; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "') { q++; break; } q++; } } if (LocaleCompare(keyword, "<!ATTLIST", 9) == 0) { / Skip to the end of the ATTLIST declaration / while (*q

Goal Reached Thanks to every supporter — we hit 100%!

ImageMagick policy.xml unterminated DOCTYPE parsing exception

More from this source