Dylan M. Taylor 2e2faec1a3 security(raw): cap lossless-JPEG Huffman table builds ...

Each DHT definition for table id 0..3 calls Huffman::new, which
allocates and fills a ~48 KiB lookup pair. A stream repeating DHT
definitions (and DNG tiles referencing such a stream) could rebuild
tables thousands of times, multiplying header-processing cost and
memory churn while producing little output.

A real lossless JPEG uses a handful of Huffman tables; cap cumulative
table builds per stream at 64 and reject streams that exceed it.

Finding: 7a31b581-d1b7-4f9c-91e5-ce42b47db87f (CWE-400)

2026-10-22 07:10:24 -04:00

..

affinity

…

algo

Merge PR #7904: Filter Gallery › Halftone Pattern: a tone-keeping screen at 45°

2026-10-21 21:56:21 +00:00

automation

test: use tokio::time::sleep in async test poll loop (SonarCloud rust:S7488) (#8373)

2026-10-21 19:35:38 -04:00

cms

Merge upstream main into fix/6752-heic-hlg

2026-10-20 21:19:06 -04:00

codecs

Merge PR #6873: HEIF: honour the nclx colour description; HLG/PQ HEICs open as linear BT.2020 32-bit (#6752)

2026-10-21 21:56:21 +00:00

color

Merge PR #6146: refactor: share hsb conversions between photocraft-color and the color picker

2026-10-21 21:55:49 +00:00

compose

security(compose): bound dense mask working set

2026-10-22 07:10:08 -04:00

doc

Merge remote-tracking branch 'origin/main' into integration-batch-5

2026-10-21 19:50:16 +02:00

engine

Merge main into #3283

2026-10-22 02:16:49 +00:00

format

Merge PR #7694: perf(format): reuse .pcraft writers between document saves

2026-10-21 21:56:10 +00:00

geom

…

gpu

Merge PR #6813: A layer that doesn't fit in GPU memory no longer breaks GPU drawing: older pages are freed and the layer is retried

2026-10-21 21:56:21 +00:00

heif

…

io

security(io): bound PDN layer-name copies

2026-10-22 07:10:15 -04:00

ipp

…

ops

Integration: Clear History resets the History Brush source and Undo brings it back, for #3534 and #3536

2026-10-21 05:04:04 +00:00

paint

Merge PR #8053: Pencil: align 1 px click snapping with the line walker (#4895)

2026-10-21 21:56:11 +00:00

plugins

…

psd

Merge remote-tracking branch 'origin/main' into integration-batch-5

2026-10-21 19:50:16 +02:00

raster

Merge main into integration-10

2026-10-21 21:56:26 +00:00

raw

security(raw): cap lossless-JPEG Huffman table builds

2026-10-22 07:10:24 -04:00

tablet

…

testkit

…

text

Merge PR #5907: Text: apply anti-alias mode shaping when rasterizing type (#5902)

2026-10-21 21:56:20 +00:00

ui-egui

Merge main into #3283

2026-10-22 02:16:49 +00:00

vector

…