Merge pull request #2501 from SixLabors/js/pbm-dos

Prevent crafted DOS attack.

Author: JimBobSquarePants

src/ImageSharp/Formats/Pbm/BufferedReadStreamExtensions.cs

@@ -28,7 +28,7 @@ public static void SkipWhitespaceAndComments(this BufferedReadStream stream)
                 {
                     innerValue = stream.ReadByte();
                 }
-                while (innerValue != 0x0a);
+                while (innerValue is not 0x0a and not -0x1);
 
                 // Continue searching for whitespace.
                 val = innerValue;

tests/ImageSharp.Tests/Formats/Pbm/PbmMetadataTests.cs

@@ -1,6 +1,7 @@
 // Copyright (c) Six Labors.
 // Licensed under the Six Labors Split License.
 
+using SixLabors.ImageSharp.Formats;
 using SixLabors.ImageSharp.Formats.Pbm;
 using static SixLabors.ImageSharp.Tests.TestImages.Pbm;
 
@@ -80,4 +81,14 @@ public void Identify_DetectsCorrectComponentType(string imagePath, PbmComponentT
         Assert.NotNull(bitmapMetadata);
         Assert.Equal(expectedComponentType, bitmapMetadata.ComponentType);
     }
+
+    [Fact]
+    public void Identify_HandlesCraftedDenialOfServiceString()
+    {
+        byte[] bytes = Convert.FromBase64String("UDEjWAAACQAAAAA=");
+        ImageInfo info = Image.Identify(bytes);
+        Assert.Equal(default, info.Size);
+        Configuration.Default.ImageFormatsManager.TryFindFormatByFileExtension("pbm", out IImageFormat format);
+        Assert.Equal(format!, info.Metadata.DecodedImageFormat);
+    }
 }