Dylan M. Taylor 7c78c951e4 security(io): index comp IDs in PSD layer-comp import ...

decode_comps matched each nonzero layer-setting comp ID against the comp
vector with iter_mut().find(), an O(n*m) scan over two file-controlled
collections. A crafted PSD could cause quadratic CPU work during import.

Build a comp-ID-to-first-index map once and use it for setting lookups.
or_insert preserves first-match behavior for duplicate comp IDs; comp 0
(Last Document State) is still handled separately.

Finding: 47567ac0-a75f-4557-b127-ffc855e5bd8d (CWE-407)

2026-10-22 07:12:12 -04:00

..

examples

Merge PR #5109: Tests: generated large-file fixtures and a P20 number (#5107)

2026-10-21 01:06:10 +00:00

src

security(io): index comp IDs in PSD layer-comp import

2026-10-22 07:12:12 -04:00

tests

Merge main into integration-10

2026-10-21 21:56:26 +00:00

Cargo.toml

Linked smart objects: follow stored paths only to local files or the document's share

2026-10-16 16:53:13 +00:00