4 people e83bf7742e security: bound codec allocation to what a hostile file declares (#2769) ...

* security: bound codec allocation to what a hostile file declares

A GIF's first image descriptor could name a frame up to four times the
canvas budget and be charged that allocation before any size check saw
it; PNG's compressed text chunks were expanded through an unbounded
inflate; JPEG handed hostile frame headers to the allocating decoders
(zune for the common cases, jpeg-decoder for CMYK/scaled/lossless) and
let an APP1 flood drive quadratic metadata reassembly. Each now refuses
on the same max_pixels budget the other decoders honour, with a
regression test per gate.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

* Fix clippy collapsible_if in DCT-scale size check

* Check jpeg-decoder header on scaled path; cap APP1 markers in decode_codes8

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Codebuff <noreply@codebuff.com>
Co-authored-by: Dylan Taylor <dylan@craftmaker.dev>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

2026-10-24 04:32:58 -04:00

..

convert.rs

Merge track r1-ui into next

2026-10-21 14:54:06 +00:00

display.rs

LR-PREF-DISPLAY: monitor ICC profiles (display colour management)

2026-10-09 11:21:09 -07:00

encode.rs

LR-HDR-EXPORT: HLG HDR AVIF export (hdrTransfer) and a tested SDR/HDR display decision

2026-10-12 03:02:02 +11:00

exif.rs

M1.1: lightcraft-codecs decode/encode, ICC, sniffing

2026-09-30 11:30:26 -04:00

gainmap.rs

UI.9: integrate shared docking and preserve panel interactions

2026-10-10 16:22:21 -06:00

heif.rs

LR-IMP-FORMATS: HEIC decodes like libheif; release builds include it

2026-10-09 14:38:00 -07:00

icc.rs

LR-PREF-DISPLAY: monitor ICC profiles (display colour management)

2026-10-09 11:21:09 -07:00

jpeg_par.rs

LR-EXP-QUALITY: Use optimized Huffman tables for JPEG exports (#1373)

2026-10-14 07:28:30 -05:00

jpeg.rs

security: bound codec allocation to what a hostile file declares (#2769)

2026-10-24 04:32:58 -04:00

jxl_encode.rs

LR-EXP-TYPE: JPEG XL export (#247)

2026-10-10 12:19:30 -04:00

jxl.rs

Correct JPEG XL test target guard & tracked-budget claims (#1517)

2026-10-17 21:13:49 +05:30

lib.rs

Integration: #2180 keep the pixel limit as the only size cap

2026-10-21 14:49:18 +00:00

other.rs

security: bound codec allocation to what a hostile file declares (#2769)

2026-10-24 04:32:58 -04:00

png_codec.rs

security: bound codec allocation to what a hostile file declares (#2769)

2026-10-24 04:32:58 -04:00

print.rs

LRC-PRINT-JOB: print colour transform (printer / paper profiles, intent, black point compensation, print adjustment)

2026-10-12 15:15:57 +05:30

proof.rs

Soft proofing against printer ICC profiles: intent, Simulate Paper & Ink, device gamut warning

2026-10-11 19:30:46 +11:00

psd.rs

LR-EXP-PSD: settings path fields use TextField; Windows default editor via Explorer; PackBits encoder without indexing

2026-10-11 12:05:13 +00:00

sniff.rs

LR-IMP-FORMATS: HEIC decodes like libheif; release builds include it

2026-10-09 14:38:00 -07:00

space.rs

LR-IMP-FORMATS: HEIC decodes like libheif; release builds include it

2026-10-09 14:38:00 -07:00

tiff_codec.rs

TIFF: keep the default 128 MiB intermediate buffer for small pixel budgets

2026-10-18 13:18:49 +02:00

video.rs

LRC-SS-EXPORT: slideshow export to PDF, JPEG sequence and AV1 video

2026-10-11 10:35:09 +02:00

webp.rs

Part of #367: probes read image headers instead of decoding the pixels

2026-10-08 22:09:30 +00:00