GHSA-rxmq-m78w-7wmc: SixLabors ImageSharp Has Infinite Loop in GIF Decoder When Skipping Malformed Comment Extension Blocks

The analysis of the provided patches in commits 55e49262df9a057dff9b7807ed1b7bdb49187c3f and 833f3ceec35af6b775950e06f03b934546cefbf6 points to a single vulnerable function. The vulnerability, an infinite loop leading to a denial of service, is located in the SixLabors.ImageSharp.Formats.Gif.GifDecoderCore.ReadComments function. The patch introduces a crucial check for an end-of-stream condition while reading GIF comment sub-blocks. The absence of this check in the vulnerable version leads to an infinite loop when a specially crafted GIF with a malformed comment extension is processed. Therefore, any runtime profile or stack trace generated during the exploitation of this vulnerability would show the SixLabors.ImageSharp.Formats.Gif.GifDecoderCore.ReadComments function as the point of failure.