Brandon ThomasandClaude Opus 5.5 6058068266 Never crash: absurd image-mask and CCITT sizes are refused before decoding ...

The first full nightly fuzz run on main (now that the runner survives) found
two 4 GiB allocations, caught by the 4 GiB child cap:
- an inline stencil mask claiming /W 4294967295 was decoded in hayro-interpret
  before the renderer's MAX_IMAGE_PIXELS check could skip it (locally 9.6 GB,
  42 s). Vendored patch image_size_ok: images and masks over 2^28 pixels are
  not decoded.
- a CCITT image whose /DecodeParms claimed /Columns 4294967295 (with a small
  /Width) sized the decoder's line buffers (locally 4.3 GB). Vendored patch
  ccitt_size_ok in hayro-syntax: at most 2^20 columns and 2^28 pixels.
Both findings now run in 7 MB. Synthetic regression test in render.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-05 00:10:17 -04:00

..

src

Never crash: absurd image-mask and CCITT sizes are refused before decoding

2026-10-05 00:10:17 -04:00

Cargo.toml

more progress, roadmap, wip

2026-09-30 11:00:02 -04:00