libmagic Type Confusion via Deep JSON Nesting

Pattern

• The application validates upload type using file or libmagic bindings
• Dangerous formats such as HTML, SVG, or script-capable content are blocked
• A later processing stage handles the uploaded file based on the detected type

Root Cause

libmagic's JSON detector includes a recursion guard:

if (lvl > 500) {
    return 0;
}

Once nesting exceeds the guard, libmagic stops treating the file as JSON. If another recognizable signature is embedded, classification may fall through to that type instead.

Version Differences