mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-09-12 21:58:58 -04:00
Dominik Schmidt
7f687ea288
The imaging build decodes the full pixel buffer from the header-declared dimensions before the existing MaxInputWidth/MaxInputHeight guard runs, so a tiny crafted file whose header declares huge dimensions forces a multi-GB allocation and can OOM the worker. Read the header with DecodeConfig and reject oversized sources before the decode allocates, in both the imaging and vips builds, and thread the limit through the audio cover-art and geogebra decoders that decode a second attacker-controlled image.
34 lines
918 B
Go
34 lines
918 B
Go
//go:build !enable_vips
|
|
|
|
package preprocessor
|
|
|
|
import (
|
|
"image"
|
|
"io"
|
|
|
|
"github.com/kovidgoyal/imaging"
|
|
"github.com/pkg/errors"
|
|
)
|
|
|
|
// ImageDecoder is a converter for the image file
|
|
type ImageDecoder struct{ limit decodeLimit }
|
|
|
|
// Convert reads the image file and returns the thumbnail image
|
|
func (i ImageDecoder) Convert(r io.Reader) (any, error) {
|
|
// bound the declared dimensions before imaging.Decode allocates the full
|
|
// pixel buffer: a crafted header (e.g. 65535x65535) would otherwise OOM
|
|
// the worker, the downstream dimension guard only runs after the decode
|
|
r, err := i.limit.guardDimensions(r, func(rr io.Reader) (image.Config, error) {
|
|
cfg, _, err := image.DecodeConfig(rr)
|
|
return cfg, err
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
img, err := imaging.Decode(r, imaging.AutoOrientation(true))
|
|
if err != nil {
|
|
return nil, errors.Wrap(err, `could not decode the image`)
|
|
}
|
|
return img, nil
|
|
}
|