umputun / remark42
84%
master: 85%

LAST BUILD BRANCH: refs/tags/backend/v1.16.0
DEFAULT BRANCH: master
Repo Added
Token eqCnozHBf54UGZ8kokrZbOvkEkhZY23aj regen
Build 1639 Last
Files 52
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix-image-decompression-bomb
branch: fix-image-decompression-bomb
CHANGE BRANCH
x
Sync Branches

coverage: 84.273% (+0.02%) from 84.25%
26199712850

Pull #2064

github

paskal 
fix(image): reject decompression-bomb dimensions before raster decode

readAndValidateImage caps the byte size of incoming images but the resize()
helper that follows still called image.Decode unconditionally, allocating
pixel memory proportional to the *declared* image dimensions. A ~100 KB
compressed PNG or GIF that declares 65535x65535 px forces image.Decode to
allocate ~17 GB of raster, OOMing the service on a single comment upload
(or on the proxy's CacheExternal path when caching a malicious upstream).

Hardening:

- maxImagePixels = 16 MP constant. Covers any realistic image (~4096x4096)
  while bounding peak allocation.
- resize() now runs image.DecodeConfig first (cheap, no pixel allocation)
  to read declared width/height before any full decode.
- Multiplication of width × height uses int64 to defeat 32-bit overflow
  (GOARCH=386, 32-bit arm): on those targets, int(cfg.Width)*int(cfg.Height)
  could wrap below maxImagePixels and bypass the cap. GIF's 16-bit logical
  screen and JPEG's 16-bit SOF dimensions both reach this if int-multiplied.
- Bytes exceeding the cap, or non-image input that fails DecodeConfig,
  return nil. prepareImage propagates the rejection as a clear error
  instead of storing the malformed/oversized data verbatim.
- The no-resize-needed path returns the validated original bytes verbatim
  so animated GIFs round-trip without being flattened to a single frame.

The DecodeConfig precheck applies even when MaxWidth/MaxHeight are 0
(resize disabled) — the dimension cap is unconditional defense-in-depth.

Two adjacent fixes surfaced by the new resize contract:

1. readAndValidateImage previously did `data[:512]` without a bounds check,
   panicking on any body shorter than 512 bytes. Now bounded with min().
2. image/webp was listed as an allowed format but no WebP decoder was
   registered, so DecodeConfig would refuse legitimate WebP uploads. Added
   `_ "golang.org/x/image/webp"` (already in go.mod via x/image/draw) so
   ... (continued)
Pull Request #2064: fix(image): reject decompression-bomb dimensions before raster decode

28 of 31 new or added lines in 2 files covered. (90.32%)

1 existing line in 1 file now uncovered.

6280 of 7452 relevant lines covered (84.27%)

34.35 hits per line

Relevant lines Covered
7452 RELEVANT LINES 6280 COVERED LINES
34.35 HITS PER LINE
Source Files on fix-image-decompression-bomb

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
26199712850 fix-image-decompression-bomb fix(image): reject decompression-bomb dimensions before raster decode readAndValidateImage caps the byte size of incoming images but the resize() helper that follows still called image.Decode unconditionally, allocating pixel memory proportional ... Pull #2064 paskal github
84.27
26198482866 fix-image-decompression-bomb fix(image): reject decompression-bomb dimensions before raster decode readAndValidateImage caps the byte size of incoming images but the resize() helper that follows still called image.Decode unconditionally, allocating pixel memory proportional ... Pull #2064 paskal github
84.27
26198053920 fix-image-decompression-bomb fix(image): reject decompression-bomb dimensions before raster decode readAndValidateImage caps the byte size of incoming images but the resize() helper that follows still called image.Decode unconditionally, allocating pixel memory proportional ... Pull #2064 paskal github
84.27
26196592896 fix-image-decompression-bomb fix(image): reject decompression-bomb dimensions before raster decode readAndValidateImage caps the byte size of incoming images but the resize() helper that follows still called image.Decode unconditionally, allocating pixel memory proportional ... Pull #2064 paskal github
84.27
26196558529 fix-image-decompression-bomb fix(image): reject decompression-bomb dimensions before raster decode readAndValidateImage caps the byte size of incoming images but the resize() helper that follows still called image.Decode unconditionally, allocating pixel memory proportional ... Pull #2064 paskal github
84.27
26196545141 fix-image-decompression-bomb fix(image): reject decompression-bomb dimensions before raster decode readAndValidateImage caps the byte size of incoming images but the resize() helper that follows still called image.Decode unconditionally, allocating pixel memory proportional ... push paskal github
84.21
See All Builds (1596)