Security Advisories (1)
CVE-2026-14454 (2026-07-08)

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. An attacker could craft an image with EXIF data that terminates a worker process.

NAME

Imager::Inline - using Imager with Inline::C.

SYNOPSIS

use Inline with => 'Imager';
use Inline C => <<'EOS';
Imager some_func(Imager::Color c, Imager::Fill f) {
  Imager img = i_img_8_new(200, 200, 3);
  /* fill with color */
  i_box_filled(img, 0, 0, 199, 199, c);
  /* inner area with fill */
  i_box_cfill(img, 50, 50, 149, 149, f);

  return img;
}
EOS

DESCRIPTION

Imager hooks into Inline's with syntax to make it easier to write Inline::C code that works with Imager, you can call Imager functions without having to include headers or perform initialization.

Imager's Inline with support does the following:

  • add the installed Imager include directory to INC

  • add the Imager typemap to TYPEMAPS

  • include the headers needed by Imager C extension modules.

  • declare and initialize the Imager API function table pointer

  • filter the supplied code to replace Imager's class names with those that Inline::C can handle.

LIMITATIONS

The filtering mechanism is global, it will replace the class names even inside string constants. If you need a string matching the name of one of Imager's classes, like "Imager::Color" you will need to split it into 2 to use C's string pasting mechanism, for example: "Imager:" ":Color".

AUTHOR

Tony Cook <tonyc@cpan.org>

REVISION

$Revision$

SEE ALSO

Imager, Imager::ExtUtils, Imager::API, Imager::APIRef, samples/inline_replace_color.pl