wordcraft

mirror of https://github.com/storytold/wordcraft.git synced 2026-11-03 08:50:02 -06:00

Files

T

Martin BallandClaude Opus 5.5 5155d2c18c #3703 : WOFF and WOFF2 sizes are checked before the decoder allocates from them

Findings 39 and 70.

39: wuff inflates each WOFF 1.0 table into a buffer sized from the
directory's origLength, before anything checks it against our 128 MB
cap, so a tiny file could ask for gigabytes. The directory's table sizes
are now summed first and a file over MAX_DECODED_BYTES is TooLarge.

70: wuff's WOFF2 glyf reconstruction allocates a glyph's points from its
nPoints counts and checks the 65536-point limit only afterwards. The
brotli stream is now decompressed by us (brotli-decompressor, already in
the tree through wuff) and every transformed glyf table's per-glyph point
totals are checked before wuff unpacks them; a glyph over the limit (which
wuff would refuse anyway) is refused up front.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-25 21:02:01 -04:00

control-key

File: recover unsaved work after a crash (#518 ) (#586 )

2026-10-14 17:21:57 -04:00

doc

#3642 : review — the DIFAT sample is test-only, valid .doc/.xls files pass the guard, and budget drops are logged

2026-10-25 23:47:39 +00:00

docbin

#3692 : review — docbin timing tests get a margin a busy CI machine can't break

2026-10-25 23:47:39 +00:00

docx

#3642 : review — the DIFAT sample is test-only, valid .doc/.xls files pass the guard, and budget drops are logged