Scarfski/basis_universal
1
0
Fork 0
mirror of https://github.com/BinomialLLC/basis_universal.git synced 2026-10-27 19:25:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Wuffs LDR loader: cap the decoder work buffer at 1 GiB (was 3 GiB)

Browse Source 
Bounds the memory a small corrupt/truncated file claiming a huge image can make the loader allocate
before Wuffs fails. Images within the 16384 dimension cap that need a larger work buffer (the largest
progressive JPEGs, ~>9.4K^2 CMYK 4:4:4 / ~>10.9K^2 YCbCr 4:4:4, and 8-bit RGBA PNGs right at 16384^2)
are now rejected with the work-buffer error. Still overridable with -DBASISU_WUFFS_LDR_MAX_WORKBUF_BYTES.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Richard Geldreich
2026-10-23 16:57:04 -04:00
co-authored by Claude Opus 5.5
parent 2c13154fa3
commit f4e2f6daad
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
encoder/basisu_enc.h
+5 -6
View File
@@ -3997,13 +3997,12 @@ namespace basisu
#ifndef BASISU_WUFFS_LDR_MAX_DIM
#define BASISU_WUFFS_LDR_MAX_DIM basist::BASISU_MAX_SUPPORTED_TEXTURE_DIMENSION
#endif
// Largest Wuffs work buffer we allocate. Default = the measured worst case within the 16384 cap: a progressive 4-component (CMYK/YCCK)
// 4:4:4 JPEG (exactly 3 GiB at 16384x16384). Tradeoff: every valid image within the dimension cap loads, but a small corrupt/truncated
// file whose header claims up to 16384x16384 makes the loader allocate up to 1 GiB of pixels + this much work buffer before Wuffs finds
// the data missing. A lower value (e.g. 2 GiB, jpgd's coefficient buffer limit) bounds that, at the cost of rejecting the largest
// progressive or 4:4:4 JPEGs.
// Largest Wuffs work buffer we allocate: 1 GiB. This bounds how much a small corrupt/truncated file claiming a huge image can make the
// loader allocate (up to 1 GiB of pixels + this much work buffer) before Wuffs finds the data missing. Tradeoff: images within the
// dimension cap whose decode needs more work buffer are rejected - e.g. progressive JPEGs larger than roughly 9.4K^2 (CMYK/YCCK 4:4:4,
// ~12 bytes/pixel) or 10.9K^2 (YCbCr 4:4:4, ~9 bytes/pixel), and the very largest 8-bit RGBA PNGs near 16384^2. Raise it with -D if needed.
#ifndef BASISU_WUFFS_LDR_MAX_WORKBUF_BYTES
#define BASISU_WUFFS_LDR_MAX_WORKBUF_BYTES (3ULL * 1024 * 1024 * 1024)
#define BASISU_WUFFS_LDR_MAX_WORKBUF_BYTES (1ULL * 1024 * 1024 * 1024)
#endif
// Header-only query (no pixel decode, no size cap): true dimensions of a .PNG/.TGA/.JPG/.QOI file, even one larger than the decode cap.