mirror of
https://github.com/storytold/wordcraft.git
synced 2026-11-10 12:20:12 -06:00
Martin BallandClaude Opus 5.5
5155d2c18c
Findings 39 and 70. 39: wuff inflates each WOFF 1.0 table into a buffer sized from the directory's origLength, before anything checks it against our 128 MB cap, so a tiny file could ask for gigabytes. The directory's table sizes are now summed first and a file over MAX_DECODED_BYTES is TooLarge. 70: wuff's WOFF2 glyf reconstruction allocates a glyph's points from its nPoints counts and checks the 65536-point limit only afterwards. The brotli stream is now decompressed by us (brotli-decompressor, already in the tree through wuff) and every transformed glyf table's per-glyph point totals are checked before wuff unpacks them; a glyph over the limit (which wuff would refuse anyway) is refused up front. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
20 lines
519 B
TOML
20 lines
519 B
TOML
[package]
|
|
name = "wordcraft-fonts"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
description = "WordCraft fonts: font database (bundled OFL + system), metrics, glyph outlines, shaping"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
kurbo = { workspace = true }
|
|
skrifa = { workspace = true }
|
|
harfrust = { workspace = true }
|
|
wuff = { workspace = true }
|
|
brotli-decompressor = { workspace = true }
|
|
unicode-bidi = { workspace = true }
|
|
unicode-script = { workspace = true }
|
|
log = { workspace = true }
|