From 8dec34dbd49f69f66d359e6c74dab8a38fb24630 Mon Sep 17 00:00:00 2001 From: Dominik Schmidt Date: Tue, 18 Aug 2026 14:46:46 +0200 Subject: [PATCH] fix(thumbnails): cap the served raw preview length Reject a preview whose declared length exceeds 100MB rather than serving it; previews are camera-generated JPEGs, so this bounds the output independently of the input file size. --- services/thumbnails/pkg/preprocessor/rawtiff.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/services/thumbnails/pkg/preprocessor/rawtiff.go b/services/thumbnails/pkg/preprocessor/rawtiff.go index bcfce9836a..5e19319690 100644 --- a/services/thumbnails/pkg/preprocessor/rawtiff.go +++ b/services/thumbnails/pkg/preprocessor/rawtiff.go @@ -46,6 +46,9 @@ const ( // the JPEG header segments walked before the SOF marker maxIFDs = 64 maxJPEGSegments = 32 + // previews are camera-generated JPEGs; tens of MB is already generous, an + // oversized declared length is rejected rather than served + maxPreviewLength = 100 * 1024 * 1024 ) // extractEmbeddedJPEG walks the IFD chain incl. SubIFDs and returns the @@ -157,7 +160,7 @@ func extractEmbeddedJPEG(data []byte) ([]byte, uint16, error) { var best []byte for _, c := range candidates { end := int64(c.offset) + int64(c.length) - if end > int64(len(data)) || int(c.length) <= len(best) { + if end > int64(len(data)) || c.length > maxPreviewLength || int(c.length) <= len(best) { continue } jpg := data[c.offset:end]