From 8a73ed9963e4e302bfb4f2fa9893579857f2fa34 Mon Sep 17 00:00:00 2001 From: bflatastic Date: Sat, 24 Oct 2026 17:19:58 +0700 Subject: [PATCH] Security bounds: fix on landing #3936 (see the PR comment) --- crates/color/src/cms/icc.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/crates/color/src/cms/icc.rs b/crates/color/src/cms/icc.rs index 2c6ede5c6..1ead944e2 100644 --- a/crates/color/src/cms/icc.rs +++ b/crates/color/src/cms/icc.rs @@ -419,7 +419,9 @@ pub(crate) fn localized_text_fits(bytes: &[u8]) -> bool { for r in 0..records { // Each record's header: language, country, length, offset. let Some(length) = r.checked_mul(12).and_then(|h| be32(tag, h + 16 + 4)) else { break }; - total = total.saturating_add(length); + // Each record counts its 12-byte header too: records of length 0 are not free, so + // many tags pointing at one `mluc` can't make this loop quadratic. + total = total.saturating_add(length).saturating_add(12); if total > MAX_LOCALIZED_TEXT { return false; }