CVE-2018-10177

An attacker provides a specially crafted MNG file to ImageMagick. When the `convert` utility (or any image-reading path) processes this file, the `ReadOneMNGImage` function enters a `do...while` loop whose termination condition depends on `image_info->magick`. Because `image_info` is never modified inside the loop, the condition never becomes false, causing an infinite loop and a denial of service [ref_id=1]. No authentication or special privileges are required; the attacker only needs to deliver the malicious file to a victim or service that processes images with ImageMagick.

The vulnerability resides in the `ReadOneMNGImage` function in `coders/png.c` (line 7428). The loop condition `LocaleCompare(image_info->magick,"MNG") == 0` never updates `image_info` inside the loop body, causing an infinite loop when processing a crafted MNG file [ref_id=1].

The advisory does not include a patch diff, but the issue is clearly identified: the loop at line 7428 checks `LocaleCompare(image_info->magick,"MNG") == 0` while `image_info` is never updated within the loop body [ref_id=1]. A proper fix would either update `image_info` inside the loop (e.g., by reassigning it from the current frame's image info) or change the loop condition to a different termination criterion that does not depend on an unchanging value. Without such a change, any MNG file that reaches this loop will cause an infinite hang.

1. Check out ImageMagick commit 11a3594 and compile with libpng support. 2. Obtain the proof-of-concept MNG file (attached as `imagemagick_7-0-7_convert_infinite-loop_ReadOneMNGImage.mng.zip` in the issue). 3. Run: `./bin/convert $POC /tmp/null.png` 4. Observe that the process hangs indefinitely due to an infinite loop in `ReadOneMNGImage` [ref_id=1].