Files
pdfcraft/vendor/hayro-jbig2/Cargo.toml
Brandon ThomasandClaude Opus 5.5 6e90710e4b Never crash: JBIG2 images can't decode billions of pixels
The nightly fuzz job found a JBIG2 symbol dictionary that decoded for
minutes: each bitmap side may be 65535, and up to 65535 symbols are decoded
pixel by pixel. Vendored hayro-jbig2 0.3.0 with two bounds: at most 2^28
pixels per bitmap (also the page bitmap, halftone grid and grayscale image),
and at most 2^26 symbol pixels per dictionary. The finding now finishes in
about a second. Synthetic regression test (a 65535 x 65535 page and region
behind a small /Width and /Height); the corpus sweep shows 0 regressions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-05 08:28:52 -04:00

130 lines
2.7 KiB
TOML

# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
#
# When uploading crates to the registry Cargo will automatically
# "normalize" Cargo.toml files for maximal compatibility
# with all versions of Cargo and also rewrite `path` dependencies
# to registry (e.g., crates.io) dependencies.
#
# If you are reading this file be aware that the original Cargo.toml
# will likely look very different (and much more reasonable).
# See Cargo.toml.orig for the original contents.
[package]
edition = "2024"
name = "hayro-jbig2"
version = "0.3.0"
authors = ["Laurenz Stampfl <laurenz.stampfl@gmail.com>"]
build = false
exclude = [
"/tests/",
"/manifest_*.json",
"/sync.py",
"/generate_huffman_tables.py",
"/benches/",
]
autolib = false
autobins = false
autoexamples = false
autotests = false
autobenches = false
description = "A memory-safe, pure-Rust JBIG2 decoder."
readme = "README.md"
license = "Apache-2.0 OR MIT"
repository = "https://github.com/LaurenzV/hayro"
resolver = "2"
[features]
default = [
"std",
"image",
"simd",
]
image = [
"dep:image",
"std",
]
simd = [
"fearless_simd",
"std",
]
std = []
[lib]
name = "hayro_jbig2"
path = "src/lib.rs"
[[example]]
name = "jbig2png"
path = "examples/jbig2png.rs"
[dependencies.fearless_simd]
version = "0.4.0"
optional = true
[dependencies.hayro-ccitt]
version = "0.3.0"
default-features = false
[dependencies.image]
version = "0.25"
optional = true
default-features = false
[dev-dependencies.criterion]
version = "0.5"
features = ["html_reports"]
[dev-dependencies.image]
version = "0.25"
features = ["png"]
default-features = false
[dev-dependencies.indicatif]
version = "0.17"
features = ["rayon"]
[dev-dependencies.rayon]
version = "1.11"
[dev-dependencies.serde]
version = "1"
features = ["derive"]
[dev-dependencies.serde_json]
version = "1"
[lints.clippy]
collection_is_never_read = "warn"
dbg_macro = "warn"
debug_assert_with_mut_call = "warn"
default_trait_access = "warn"
doc_markdown = "warn"
fn_to_numeric_cast_any = "warn"
infinite_loop = "warn"
large_stack_arrays = "warn"
mismatching_type_param_order = "warn"
negative_feature_names = "warn"
redundant_feature_names = "warn"
same_functions_in_if_condition = "warn"
semicolon_if_nothing_returned = "warn"
todo = "warn"
too_many_arguments = "allow"
unseparated_literal_suffix = "warn"
use_self = "warn"
wildcard_dependencies = "warn"
[lints.rust]
elided_lifetimes_in_paths = "warn"
keyword_idents_2024 = "forbid"
missing_docs = "warn"
non_ascii_idents = "forbid"
non_local_definitions = "forbid"
trivial_numeric_casts = "warn"
unnameable_types = "warn"
unreachable_pub = "warn"
unsafe_op_in_unsafe_fn = "forbid"
unused_import_braces = "warn"
unused_lifetimes = "warn"
unused_macro_rules = "warn"
unused_qualifications = "warn"