iccDEV Stack Overflow Vulnerability in XML Calculator Macro Expansion

A stack overflow vulnerability has been identified in the iccDEV library, prior to version 2.3.1.2. The issue arises in the XML calculator macro expansion, where self-referential macros can cause infinite recursion, leading to a stack overflow. This vulnerability requires user interaction to exploit, as it involves processing ICC color profiles with the affected version of iccDEV.

Impact

Exploitation of this vulnerability causes a stack overflow, which can lead to a crash of the application processing the ICC color profile.

Reproduction

The vulnerability can be reproduced by using an ICC profile that includes a macro reference that points to itself, creating a circular reference. This can be done by manually crafting an ICC profile with such a macro or by using the 'iccFromXml' command-line tool with a specially designed XML file that triggers the vulnerability.

Remediation

Users can update to iccDEV version 2.3.1.2 or later, where this vulnerability has been fixed. Instructions for updating can be found in the iccDEV repository on GitHub.