DoS in Perl Imager: crafted TGA colour map length triggers uncatchable process exit
AI analysis
Imager versions before 1.036 for Perl mis-handle Truevision TGA files whose colour map length field is 32768 or greater: the two-byte length is unpacked as a signed short and becomes negative, and tga_palette_read() then casts it to size_t, producing an allocation request near SIZE_MAX. When mymalloc() cannot satisfy that request, Imager's allocator calls exit(3), terminating the entire process in a way that Perl-level exception handling cannot intercept. An attacker who can supply a crafted TGA file to any code path that calls Imager->read() — such as web image-upload processing, thumbnailing, or image-conversion services — gains a reliable remote denial-of-service with a single file. All deployments running Imager 1.035 or earlier that process externally supplied images are affected. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known, and a CVSS score has not yet been assigned.
What to do: Upgrade to Imager 1.036 or later, which corrects the signed length handling in tga_palette_read. As interim mitigation, reject or pre-validate TGA uploads (particularly the colour map length field) and run image parsing in a separate supervised worker process, since exit(3) cannot be caught inside the application. Audit all code paths where user-supplied files reach Imager->read() to confirm they are covered by the fix or mitigation.
Affected
| Imager (CPAN distribution) Imager (Perl image processing module) | all versions before 1.036 |
Estimated exposure
nichelikely thousands to tens of thousands of Perl deployments worldwide (long-standing CPAN module; exact install counts not published in the source data) — Estimated from Imager's status as a widely used CPAN image-processing library typically embedded in Perl web, thumbnailing, and batch-processing pipelines, with real exposure further narrowed by the requirement that applications read…
Description
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3). Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.