From 7f9f97148d80c96293aa8c4df3c5e2ebbc49e00b Mon Sep 17 00:00:00 2001 From: aiongg Date: Wed, 21 Oct 2026 14:48:45 +0000 Subject: [PATCH] Integration: #2178 document the bound (from #2157) Co-authored-by: ronibalthazar <61232335+ronibalthazar@users.noreply.github.com> --- crates/tiff/README.md | 9 ++++++--- crates/tiff/src/lib.rs | 5 +++-- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/crates/tiff/README.md b/crates/tiff/README.md index e6a771288..2436b0d31 100644 --- a/crates/tiff/README.md +++ b/crates/tiff/README.md @@ -29,9 +29,12 @@ later the TIFF/DNG exporters. The reader never panics on malformed input (proptests feed random and mutated files): offsets are bounds-checked; out-of-range or unknown-type entries are skipped; IFD loops are detected; IFD count, -nesting depth and entries per IFD are limited; a next-IFD pointer is followed only when every declared entry was -read, with the counts compared as 64-bit numbers (a BigTIFF declaring 4,294,967,297 entries but holding one can't -pass for a whole directory on a 32-bit target); the total bytes of decoded values are capped at +nesting depth and entries per IFD are limited; at most 65,536 directory entry slots +(`ParseOptions::max_entries_total`) are accepted across the main IFD chain and all child IFDs, even when tables +overlap at distinct offsets, and an IFD past that bound ends the chain or is skipped like any other bad IFD after +the first; a next-IFD pointer is followed only when every declared entry was read, with the counts compared as +64-bit numbers (a BigTIFF declaring 4,294,967,297 entries but holding one can't pass for a whole directory on a +32-bit target); the total bytes of decoded values are capped at `8 × input + 1 MiB` so a file cannot make us allocate far more than its own size. ## Sources diff --git a/crates/tiff/src/lib.rs b/crates/tiff/src/lib.rs index 1d0b74d0d..2072c4936 100644 --- a/crates/tiff/src/lib.rs +++ b/crates/tiff/src/lib.rs @@ -11,8 +11,9 @@ //! either byte order, classic or BigTIFF. //! //! The reader never panics on malformed input: every offset is bounds-checked, IFD loops are -//! detected, nesting depth / IFD count are limited and the total amount of decoded value bytes is -//! capped relative to the input size (so a hostile file cannot make us allocate unboundedly). +//! detected, nesting depth / IFD count are limited, at most 65,536 directory entry slots are read +//! across the main chain and child IFDs, and decoded value bytes are capped relative to the input +//! size (so overlapping tables cannot multiply entry-vector allocations without bound). //! //! Sources: TIFF 6.0 specification (Adobe, 1992), TIFF Technical Note / supplements, the BigTIFF //! design notes (AWare Systems), Adobe DNG specification 1.7 (tag numbers), CIPA DC-008 (Exif 2.32).