Dylan M. Taylor fcdb572cd6 security(io): admit embedded SVG raster images by header size ...

Embedded PNG and WebP images reached resvg using only their displayed
destination area, while resvg/tiny-skia allocate and decode the full
intrinsic source image first. A highly compressed large image could
therefore trigger gigabyte-scale allocation and decompression outside
the importer's destination-memory accounting.

Wrap usvg's default image-href data resolver with a check that reads
PNG dimensions directly from the IHDR chunk and WebP dimensions via
photocraft_codecs::probe_size, rejecting images whose decoded RGBA size
exceeds the raster budget before resvg ever sees them.

Findings:
- f4fc2a9e-c26f-442d-9d05-4e793d6b0f13 (CWE-789, embedded WebP allocation)
- d765fad5-678e-4f15-a8f8-3e6ee086056a (CWE-789, embedded PNG allocation)

2026-10-22 19:33:27 -04:00

..

common

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

adjust_blend_roundtrip.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

adjust_warnings.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

affinity_artboards.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

affinity_corpus.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

affinity.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

annotations.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

artboard_guide_order.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

banded.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

cancel.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

channels.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

cmyk_composite_export.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

color.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

composite.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

comps_artboards.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

corpus_regressions.rs

Keep tests correct and docs current with one test binary per crate

2026-10-22 16:55:34 +00:00

corpus.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

effects_multi.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

exif_resolution.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

export_progress.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

exr_part_profile.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

flat.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

gif_frames.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

guides_v2.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

heif_unsupported.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

heif.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

krita_corpus.rs

Keep tests correct and docs current with one test binary per crate

2026-10-22 16:55:34 +00:00

lab16.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

large_files.rs

Keep tests correct and docs current with one test binary per crate

2026-10-22 16:55:34 +00:00

large_psb.rs

Keep tests correct and docs current with one test binary per crate

2026-10-22 16:55:34 +00:00

layer_labels.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

layer_xmp.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

main.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

modes.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

multichannel.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

orientation.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

pattern_fill_psd.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

pcraft_manifest_name.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

pdn_corpus.rs

Keep tests correct and docs current with one test binary per crate

2026-10-22 16:55:34 +00:00

png_text_metadata.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd16_merged_transparency.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd32_export.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_background.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_block_alignment.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_block_layout.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_damaged_merged.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_empty_channels.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_font_identity.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_kerning.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_layer_block_length.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_maximize_compatibility.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_noise_fill_roundtrip.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_roundtrip_bytes.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_structure.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_style_sheets.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_thumbnail.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_type_bounds.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_type_photoshop_bytes.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_unknown_adjustment.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

psd_vertical_type.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

raw.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

resolution_axes.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

roundtrip.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

smart_contents_identity.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

smart_corpus.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

svg.rs

security(io): admit embedded SVG raster images by header size

2026-10-22 19:33:27 -04:00

text_corpus.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

text_styles.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

tiff_corpus.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

tiff_layers.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

tiff_pages.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

tiff_type_geometry.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

vector.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

xcf.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00

xmp_export.rs

Build each crate's integration tests as one binary

2026-10-22 16:55:34 +00:00