After v14.13.1 - Security limit exceeded: Image size 160x64 exceeds the maximum image size 4225

[yngndrw]

Hello,

I'm getting the following exception while trying to load a .heic or .heif file:
ImageMagick.MagickCorruptImageErrorException : Memory allocation error: Security limit exceeded: Image size 160x64 exceeds the maximum image size 4225

Historically we were using the nuget package Magick.NET-Q8-AnyCPU with version 14.13.1 without this error, but since updating (I've tried versions 14.14.0, 14.15.0 and 14.16.0) I'm seeing this error.

Prior to this version we didn't have a profile setup, but I've sinced tried adding the following, both with the example profile and with all of the limits increased tenfold:

var configFiles = ConfigurationFiles.Default;
configFiles.Policy.Data = @"<policymap xmlns="""">
    <policy xmlns="""" domain=""Undefined"" rights=""none""/>
    <policy domain=""resource"" name=""thread"" value=""20""/>
    <policy domain=""resource"" name=""time"" value=""1200""/>
    <policy domain=""resource"" name=""file"" value=""7680""/>
    <policy domain=""resource"" name=""memory"" value=""2560MiB""/>
    <policy domain=""resource"" name=""map"" value=""5120MiB""/>
    <policy domain=""resource"" name=""area"" value=""160KP""/>
    <policy domain=""resource"" name=""disk"" value=""10GiB""/>
    <policy domain=""resource"" name=""list-length"" value=""320""/>
    <policy domain=""resource"" name=""width"" value=""80KP""/>
    <policy domain=""resource"" name=""height"" value=""80KP""/>
    <policy domain=""resource"" name=""throttle"" value=""20""/>
    <policy domain=""resource"" name=""temporary-path"" value=""/magick/tmp/""/>
    <policy domain=""cache"" name=""memory-map"" value=""anonymous""/>
    <policy domain=""cache"" name=""synchronize"" value=""true""/>
    <policy domain=""cache"" name=""shared-secret"" value=""secret-passphrase"" stealth=""true""/>
    <policy domain=""delegate"" rights=""none"" pattern=""*""/>
    <policy domain=""filter"" rights=""none"" pattern=""*""/>
    <policy domain=""path"" rights=""none"" pattern=""-""/>
    <policy domain=""path"" rights=""none"" pattern=""/etc/*""/>
    <policy domain=""path"" rights=""none"" pattern=""@*""/>
    <policy domain=""module"" rights=""write"" pattern=""{MSL,MVG,PS,SVG,TEXT,URL,XPS}""/>
    <policy domain=""system"" name=""shred"" value=""1""/>
    <policy domain=""system"" name=""memory-map"" value=""anonymous""/>
    <policy domain=""system"" name=""max-memory-request"" value=""2560MiB""/>
</policymap>";
MagickNET.Initialize(configFiles);

What am I missing? I can't seem to adjust this limit and I have no idea where this maximum image size of 4225 comes from.

[dlemstra]

Can you create a small dotnet application with a single program.cs that demonstrates the issue? Heic recently added security limits and you seem to be hitting that but I don't understand why.

[yngndrw]

Here's a minimal sample which demonstrates the problem. While creating this, I realised that it may be the test image because it worked fine when I downloaded a different sample .heic image file. I'm not sure how ios-photo.heic was created as it was created by a colleague as part of a unit test, but it does work fine with v14.13.1. (Which states that it's a 1x1 image)

It's a little curious that the exception message states that the image is 160x64.

MagickNET_HeicSizeLimitIssue.zip

I should point out that I've seen the issue on a Linux build server, a Windows 11 machine and a Windows 10 machine.

[yngndrw]

(Related ImageMagick issue: ImageMagick/ImageMagick#8898)

I've worked through and built up a list of the various affected methods across the related libraries, but I've hit a bit of a wall because I don't really understrand the detail of what is happening, I might have to raise this issue in the ImageMagick and/or libheif repositories as the issue appears to come from within those. I'll add my notes here though for reference.

Repositories:
https://github.com/dlemstra/Magick.NET
https://github.com/dlemstra/Magick.Native
https://github.com/ImageMagick/ImageMagick
https://github.com/strukturag/libheif

Full stack trace:

ImageMagick.MagickCorruptImageErrorException : Memory allocation error: Security limit exceeded: Image size 160x64 exceeds the maximum image size 4225
	(6.1000) `C:/Users/AzDevOps/AppData/Local/Temp/magick-pDf0M_S_-bYM1btMUoef0giDL5E4jeqi' @ error/heic.c/IsHEIFSuccess/207
	Stack Trace:
		at ImageMagick.NativeInstance.CheckException(IntPtr exception, IntPtr result) in /_/src/Magick.NET/Native/NativeInstance.cs:line 54
		at ImageMagick.MagickImage.NativeMagickImage.ReadBlob(IMagickSettings`1 settings, Byte[] data, UIntPtr offset, UIntPtr length) in /_/src/Magick.NET/Generated/Magick.NET.SourceGenerator/ImageMagick.SourceGenerator.NativeInteropGenerator/MagickImage.g.cs:line 6061
		at ImageMagick.MagickImage.Read(Byte[] data, UIntPtr offset, UIntPtr length, IMagickReadSettings`1 readSettings, Boolean ping, String fileName) in /_/src/Magick.NET/MagickImage.cs:line 8008
		at ImageMagick.MagickImage.Read(Byte[] data, IMagickReadSettings`1 readSettings) in /_/src/Magick.NET/MagickImage.cs:line 4870
		at ImageMagick.MagickImage.Read(Byte[] data) in /_/src/Magick.NET/MagickImage.cs:line 4806
		at ImageMagick.MagickImage..ctor(Byte[] data) in /_/src/Magick.NET/MagickImage.cs:line 54

Methods:

* [Magick.NET] ImageMagick.MagickImage.Read(Byte[] data, UIntPtr offset, UIntPtr length, IMagickReadSettings`1 readSettings, Boolean ping, String fileName):
* https://github.com/dlemstra/Magick.NET/blob/main/src/Magick.NET/MagickImage.cs#L8000-L8011
private void Read(byte[] data, nuint offset, nuint length, IMagickReadSettings<QuantumType>? readSettings, bool ping, string? fileName = null)
{
	var newReadSettings = CreateReadSettings(readSettings);
	SetSettings(newReadSettings);

	_settings.Ping = ping;
	_settings.FileName = fileName;

	_nativeInstance.ReadBlob(Settings, data, offset, length);

	ResetSettings();
}


* [Magick.NET] ImageMagick.MagickImage.NativeMagickImage.ReadBlob:
* (Generated)
[Throws]
[ReadInstance]
public unsafe void ReadBlob(IMagickSettings<byte>? settings, byte[] data, nuint offset, nuint length)
{
	nint exception = IntPtr.Zero;
	using INativeInstance settingsNative = MagickSettings.CreateInstance(settings);
	fixed (byte* dataFixed = data)
	{
		nint result = NativeMethods.MagickImage_ReadBlob(settingsNative.Instance, dataFixed, offset, length, out exception);
		CheckException(exception, result);
		if (result != IntPtr.Zero)
		{
			base.Instance = result;
		}
	}
}


* [Magick.NET] NativeMethods.MagickImage_ReadBlob:
* (Generated)
[DllImport("Magick.Native-Q8-x64.dll", CallingConvention = CallingConvention.Cdecl)]
public unsafe static extern nint MagickImage_ReadBlob(nint settings, byte* data, nuint offset, nuint length, out nint exception);


* [Magick.Native] MagickImage_ReadBlob:
* https://github.com/dlemstra/Magick.Native/blob/main/src/Magick.Native/MagickImage.c#L1982-L1992
MAGICK_NATIVE_EXPORT Image *MagickImage_ReadBlob(const ImageInfo *settings, const unsigned char *data, const size_t offset, const size_t length, ExceptionInfo **exception)
{
  Image
    *image;

  MAGICK_NATIVE_GET_EXCEPTION;
  image = BlobToImage(settings, (const void *) (data + offset), length, exceptionInfo);
  RemoveFrames(image);
  MAGICK_NATIVE_SET_EXCEPTION;
  return image;
}


* [ImageMagick] BlobToImage:
* https://github.com/ImageMagick/ImageMagick/blob/main/MagickCore/blob.c#L443-L542


* [ImageMagick] ReadImage:
https://github.com/ImageMagick/ImageMagick/blob/main/MagickCore/constitute.c#L604-L983


* [ImageMagick] ReadHEICImage:
https://github.com/ImageMagick/ImageMagick/blob/main/coders/heic.c#L987-L1147


* [ImageMagick] ReadHEICImageHandle:
https://github.com/ImageMagick/ImageMagick/blob/main/coders/heic.c#L431-L697


* [ImageMagick] ReadHEICExifProfile:
* https://github.com/ImageMagick/ImageMagick/blob/main/coders/heic.c#L303-L940


* [libheif] decode_image:
* https://github.com/strukturag/libheif/blob/master/libheif/image-items/image_item.cc#L882-L1226


* [libheif] check_for_valid_image_size:
* https://github.com/strukturag/libheif/blob/master/libheif/security_limits.cc#L126-L144

[dlemstra]

Your ios-photo.heic image is invalid. Recent version of libheif have added extra security checks and the image that you have has an "internal value" that is 160x64 and that now hits the security policy.

[yngndrw]

Thank you very much for investigating. I really appreciate your time and help.

[dlemstra]

I will be going to ask the libheif team to make sure it's not a bug. I checked their issues and it seems that other people are also running into this issue.

[yngndrw]

Thank you. I was also curious where the maximum image size in the error message was coming from, because it appears to be very small for a default limit and didn't appear to change when I adjusted the profile.

I did wonder if it could be a memory overflow, resulting in the limit being set to an arbitrary value.

It's unfortunate that I can't really give any detail on the test image, as it was generated by a colleague using CoPilot. It's very possible (Probable, even) that it's an invalid image, but maybe that has then exposed a flaw in the libheif validation.