| Subject: | buffer overflow when using an image based fill on a double precision image. |
Using an image based fill on a large sample output image where the
number of input channels does not match the number of output will result
in a buffer overflow of a malloc()ed buffer.
This typically results in corruption of the global memory arena.
This at least could be used as a denial of service.
Mitigating factors:
- prior to Imager 0.56 no file formats were read at large sample sizes,
so large sample images could only be created explicitly
- the values written at the end of the buffer are doubles, so if a
16-bit/sample source image is read each double can only have 1 of 65536
values instead of the full range of possible doubles