Skip to content

limit IDAT decompression size to expected_size#223

Open
nevernever69 wants to merge 1 commit into
lvandeve:masterfrom
nevernever69:limit-idat-decompression-size
Open

limit IDAT decompression size to expected_size#223
nevernever69 wants to merge 1 commit into
lvandeve:masterfrom
nevernever69:limit-idat-decompression-size

Conversation

@nevernever69

Copy link
Copy Markdown

Set max_output_size before IDAT decompression, consistent with how zTXt and iCCP chunks are already handled. This prevents large memory allocation when IDAT decompresses to more than expected.

The issue:

  • IDAT decompression doesn't set max_output_size (line 5494)
  • zTXt and iCCP already set it (lines 4939 and 5130)
  • A malformed PNG can cause large allocation before error 91

The fix:

  • Copy zlibsettings and set max_output_size = expected_size
  • Same pattern already used for zTXt/iCCP

Test result:

  • Before: 1KB PNG causes 1MB allocation, then error 91
  • After: Early error 109, no large allocation
  • Valid PNGs unaffected

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant