From c9892c8f8d45b904ce0c9648d4fd4f1e6a96ae8f Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Fri, 23 Oct 2026 14:12:04 -0400 Subject: [PATCH] security(codecs): refuse implausibly short truncated JPEG scans; charge WebP frame ICC copies A truncated JPEG scan under a large declared frame was filled out by the backend to the full admitted size; reject it when the file cannot plausibly account for the pixels. Animated WebP frames each keep a copy of the ICC profile, so the aggregate admission now counts it. --- crates/codecs/src/codecs/jpeg.rs | 25 +++++++++++++++++++++++++ crates/codecs/src/codecs/webp.rs | 4 +++- 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/crates/codecs/src/codecs/jpeg.rs b/crates/codecs/src/codecs/jpeg.rs index cf1c9fca43..26a47c13d6 100644 --- a/crates/codecs/src/codecs/jpeg.rs +++ b/crates/codecs/src/codecs/jpeg.rs @@ -182,6 +182,10 @@ fn err(e: impl std::fmt::Display) -> CodecError { CodecError::malformed(F, e) } +/// Most pixels one byte of a truncated file may account for. Even a flat image costs a few bits +/// per 8×8 block, and truncated photographs are far above this. +const MAX_TRUNCATED_PIXELS_PER_BYTE: u64 = 2048; + pub(crate) fn decode(bytes: &[u8], limits: &Limits) -> Result { let end = data_end(bytes); if end == DataEnd::Empty { @@ -204,6 +208,11 @@ pub(crate) fn decode(bytes: &[u8], limits: &Limits) -> Result _ => (ColorSpace::RGB, ChannelLayout::Rgb), }; limits.check(w, h, layout, SampleType::U8)?; + // The backend fills whatever the scan no longer describes, so a short scan under a large + // frame is a gigabyte of synthesized output from a few kilobytes of file. + if end == DataEnd::Truncated && u64::from(w) * u64::from(h) / MAX_TRUNCATED_PIXELS_PER_BYTE > bytes.len() as u64 { + return Err(err("the truncated scan is too short for the frame it declares")); + } dec.set_options(dec.options().jpeg_set_out_colorspace(out_cs)); let mut px = dec.decode().map_err(err)?; let expected = w as usize * h as usize * layout.channels(); @@ -435,6 +444,22 @@ mod tests { bytes.get(2..11) == Some(b"\xff\xe0\0\x10JFIF\0") } + /// A tiny truncated scan under a frame patched to 20000×20000 is refused before the backend + /// fills 400 million pixels from it; the same file with its real size still recovers. + #[test] + fn a_short_truncated_scan_cannot_declare_a_huge_frame() { + let img = Image::from_raw(16, 16, ChannelLayout::Rgb, SampleType::U8, vec![128; 16 * 16 * 3]).unwrap(); + let full = crate::encode(&img, Format::Jpeg, &EncodeOptions::default()).unwrap(); + let cut = &full[..full.len() - 4]; + assert_eq!(data_end(cut), DataEnd::Truncated); + assert!(crate::decode_as(Format::Jpeg, cut).is_ok()); + let sof = cut.windows(2).position(|w| w == [0xFF, 0xC0] || w == [0xFF, 0xC2]).unwrap(); + let mut huge = cut.to_vec(); + huge[sof + 5..sof + 9].copy_from_slice(&[0x4E, 0x20, 0x4E, 0x20]); + let e = crate::decode_as(Format::Jpeg, &huge).unwrap_err(); + assert!(e.to_string().contains("too short"), "{e}"); + } + /// CMYK JPEG output must omit JFIF while retaining Adobe's CMYK marker. #[test] fn cmyk_jpeg_omits_jfif_but_keeps_adobe_cmyk_marker() { diff --git a/crates/codecs/src/codecs/webp.rs b/crates/codecs/src/codecs/webp.rs index f109f62e96..42afce3140 100644 --- a/crates/codecs/src/codecs/webp.rs +++ b/crates/codecs/src/codecs/webp.rs @@ -85,7 +85,9 @@ pub(crate) fn decode_frames(bytes: &[u8], limits: &Limits) -> Result= MAX_GIF_FRAMES { return Err(CodecError::LimitExceeded(format!("more than {MAX_GIF_FRAMES} frames"))); } - if (size as u64).saturating_mul(out.len() as u64 + 1) > limits.max_alloc { + // Every frame keeps its own copy of the file's ICC profile along with its pixels. + let frame_bytes = (size as u64).saturating_add(icc.as_ref().map_or(0, |p| p.len() as u64)); + if frame_bytes.saturating_mul(out.len() as u64 + 1) > limits.max_alloc { return Err(CodecError::LimitExceeded(format!("{} frames of {w}x{h} exceed max_alloc {}", out.len() + 1, limits.max_alloc))); } let delay_ms = match dec.read_frame(&mut buf) {