mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-23 07:05:56 +02:00
Dylan M. Taylor
ef4e13dc2d
The importer bounded and inflated the top-level .svgz once, then handed the result to usvg::Tree::from_data, which re-checks the gzip magic and decompresses again with no byte limit of its own if the content happens to start with a nested gzip stream. The same default resolver decompresses embedded image/svg+xml data URLs (SVGZ-in-data-URL) the same unbounded way. Parse the already-bounded top-level text with Tree::from_str, which never decompresses. Wrap the image-href resolver so a gzip-compressed embedded SVG is inflated through our bounded inflate() first; the already-plain bytes handed to the default resolver no longer start with the gzip magic, so it parses them directly instead of decompressing a second time. Finding: a6444163-e510-4925-ae63-727658b6582e (CWE-409)