Martin BallandClaude Opus 5.5 4963e30eed #3692: a row's gridAfter is bounded like the DOCX reader's ...

Audit finding 35: Table::cols() added a deserialized row's grid_after
(u32) unchecked, and layout_table sized its column vectors from it, so a
small native JSON document could ask for a 16 GB grid (and overflow the
sum on 32-bit wasm). Row::grid_after() now clamps to MAX_COLS as
first_grid() does and the importer does; cols() sums with saturating
adds; layout reads the bounded value. Test:
tests_budget::a_huge_grid_after_is_bounded_like_the_docx_readers.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-25 21:01:25 -04:00

..

src

#3692: a row's gridAfter is bounded like the DOCX reader's

2026-10-25 21:01:25 -04:00

Cargo.toml

Pictures: one decoder checks the header against the budget, progressive JPEG coefficients included (#3644)

2026-10-24 18:01:45 -01:00