This is an automated email from the git hooks/post-receive script.
git pushed a commit to branch master
in repository legacy-imlib2.
View the commit online.
commit 7da3157b8ff413dfa0fe4f99047b320c8f44ef0e
Author: Acts1631 <[email protected]>
AuthorDate: Tue Jul 21 19:48:49 2026 +0200
loaders: limit decompressed temporary output
Compressed image wrappers expanded input into /tmp without a size
limit before validating the nested image. A small file could exhaust
shared temporary storage.
Now stop decompression after 128 MiB.
---
src/modules/loaders/compression.h | 6 ++++++
src/modules/loaders/decompress_load.c | 20 ++++++++++++++++++++
src/modules/loaders/loader_bz2.c | 3 ++-
src/modules/loaders/loader_lzma.c | 3 ++-
src/modules/loaders/loader_zlib.c | 3 ++-
5 files changed, 32 insertions(+), 3 deletions(-)
diff --git a/src/modules/loaders/compression.h b/src/modules/loaders/compression.h
index 3d35a02..b81abef 100644
--- a/src/modules/loaders/compression.h
+++ b/src/modules/loaders/compression.h
@@ -1,11 +1,17 @@
#ifndef COMPRESSION_H
#define COMPRESSION_H 1
+#include <stddef.h>
+
typedef int (imlib_decompress_load_f) (const void *fdata,
unsigned int fsize, int dest);
+#define IMLIB2_DECOMPRESS_MAX_SIZE (128U * 1024U * 1024U)
+
int decompress_load(ImlibImage * im, int load_data,
const char *const *pext, int next,
imlib_decompress_load_f * fdec);
+int decompress_write(int dest, const void *buf, size_t len,
+ size_t *written);
#endif /* COMPRESSION_H */
diff --git a/src/modules/loaders/decompress_load.c b/src/modules/loaders/decompress_load.c
index e94e33d..b783608 100644
--- a/src/modules/loaders/decompress_load.c
+++ b/src/modules/loaders/decompress_load.c
@@ -1,7 +1,27 @@
#include "config.h"
+
+#include <errno.h>
+
#include "Imlib2_Loader.h"
#include "compression.h"
+int
+decompress_write(int dest, const void *buf, size_t len, size_t *written)
+{
+ if (*written > IMLIB2_DECOMPRESS_MAX_SIZE ||
+ len > IMLIB2_DECOMPRESS_MAX_SIZE - *written)
+ {
+ errno = EFBIG;
+ return 0;
+ }
+
+ if (write(dest, buf, len) != (ssize_t)len)
+ return 0;
+
+ *written += len;
+ return 1;
+}
+
int
decompress_load(ImlibImage *im, int load_data, const char *const *pext,
int next, imlib_decompress_load_f *fdec)
diff --git a/src/modules/loaders/loader_bz2.c b/src/modules/loaders/loader_bz2.c
index 357e6d2..02caa71 100644
--- a/src/modules/loaders/loader_bz2.c
+++ b/src/modules/loaders/loader_bz2.c
@@ -16,6 +16,7 @@ uncompress_file(const void *fdata, unsigned int fsize, int dest)
bz_stream strm = { 0 };
int ret, bytes;
char outbuf[OUTBUF_SIZE];
+ size_t written = 0;
ok = 0;
@@ -37,7 +38,7 @@ uncompress_file(const void *fdata, unsigned int fsize, int dest)
goto quit;
bytes = sizeof(outbuf) - strm.avail_out;
- if (write(dest, outbuf, bytes) != bytes)
+ if (!decompress_write(dest, outbuf, bytes, &written))
goto quit;
if (ret == BZ_STREAM_END)
diff --git a/src/modules/loaders/loader_lzma.c b/src/modules/loaders/loader_lzma.c
index 898b3b5..85b4e2f 100644
--- a/src/modules/loaders/loader_lzma.c
+++ b/src/modules/loaders/loader_lzma.c
@@ -16,6 +16,7 @@ uncompress_file(const void *fdata, unsigned int fsize, int dest)
lzma_ret ret;
uint8_t outbuf[OUTBUF_SIZE];
ssize_t bytes;
+ size_t written = 0;
ok = 0;
@@ -37,7 +38,7 @@ uncompress_file(const void *fdata, unsigned int fsize, int dest)
goto quit;
bytes = sizeof(outbuf) - strm.avail_out;
- if (write(dest, outbuf, bytes) != bytes)
+ if (!decompress_write(dest, outbuf, bytes, &written))
goto quit;
if (ret == LZMA_STREAM_END)
diff --git a/src/modules/loaders/loader_zlib.c b/src/modules/loaders/loader_zlib.c
index 27528c0..21c5b73 100644
--- a/src/modules/loaders/loader_zlib.c
+++ b/src/modules/loaders/loader_zlib.c
@@ -15,6 +15,7 @@ uncompress_file(const void *fdata, unsigned int fsize, int dest)
z_stream strm = { 0 };;
unsigned char outbuf[OUTBUF_SIZE];
int ret = 1, bytes;
+ size_t written = 0;
ok = 0;
@@ -36,7 +37,7 @@ uncompress_file(const void *fdata, unsigned int fsize, int dest)
goto quit;
bytes = sizeof(outbuf) - strm.avail_out;
- if (write(dest, outbuf, bytes) != bytes)
+ if (!decompress_write(dest, outbuf, bytes, &written))
goto quit;
if (ret == Z_STREAM_END)
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
