mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-09-16 07:45:09 -04:00
Dominik Schmidt
7f687ea288
The imaging build decodes the full pixel buffer from the header-declared dimensions before the existing MaxInputWidth/MaxInputHeight guard runs, so a tiny crafted file whose header declares huge dimensions forces a multi-GB allocation and can OOM the worker. Read the header with DecodeConfig and reject oversized sources before the decode allocates, in both the imaging and vips builds, and thread the limit through the audio cover-art and geogebra decoders that decode a second attacker-controlled image.
31 lines
721 B
Go
31 lines
721 B
Go
//go:build enable_vips
|
|
|
|
package preprocessor
|
|
|
|
import (
|
|
"io"
|
|
|
|
"github.com/davidbyttow/govips/v2/vips"
|
|
|
|
thumbnailerErrors "github.com/opencloud-eu/opencloud/services/thumbnails/pkg/errors"
|
|
)
|
|
|
|
func init() {
|
|
vips.LoggingSettings(nil, vips.LogLevelError)
|
|
}
|
|
|
|
type ImageDecoder struct{ limit decodeLimit }
|
|
|
|
func (v ImageDecoder) Convert(r io.Reader) (interface{}, error) {
|
|
// NewImageFromReader is header-lazy, Width/Height read the header without
|
|
// materializing pixels: reject oversized sources before ThumbnailWithSize
|
|
img, err := vips.NewImageFromReader(r)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if v.limit.exceeded(img.Width(), img.Height()) {
|
|
return nil, thumbnailerErrors.ErrImageTooLarge
|
|
}
|
|
return img, nil
|
|
}
|