Validate ICC configured size does not surpass bmp file size - #3095
Merged
197g merged 1 commit intoAug 3, 2026
Merged
Conversation
197g
approved these changes
Aug 3, 2026
scadastrangelove
added a commit
to scadastrangelove/rust-in-peace
that referenced
this pull request
Aug 4, 2026
… number Chromium issue was mis-recorded as 537617321 since filing (2026-07-22); the real number is 537617325, confirmed via the Buganizer notification and image-rs/image#3094 independently citing it. telecos (Microsoft/Edge) root-caused our report into image-rs/image and merged a fix same day (2026-08-03); Chromium's own vendored copy isn't confirmed updated yet. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
brave-builds
pushed a commit
to brave/chromium
that referenced
this pull request
Aug 5, 2026
Incorporate patch from image crate PR: image-rs/image#3095 To validate that icc profile size is not surpassing remaining stream size. Add regression test for the case. Bug: 537617325 Change-Id: Id1459a21f9fbb9a58ff05e4e8346eab508e81943 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8183991 Reviewed-by: Daniel Cheng <dcheng@chromium.org> Reviewed-by: Florin Malita <fmalita@chromium.org> Commit-Queue: Sergio Gonzalez Martin <sergiog@microsoft.com> Cr-Commit-Position: refs/heads/main@{#1674242}
mohd-akram
pushed a commit
to gsource-mirror/chromium-src-third_party-rust
that referenced
this pull request
Aug 5, 2026
Incorporate patch from image crate PR: image-rs/image#3095 To validate that icc profile size is not surpassing remaining stream size. Add regression test for the case. Bug: 537617325 Change-Id: Id1459a21f9fbb9a58ff05e4e8346eab508e81943 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8183991 Reviewed-by: Daniel Cheng <dcheng@chromium.org> Reviewed-by: Florin Malita <fmalita@chromium.org> Commit-Queue: Sergio Gonzalez Martin <sergiog@microsoft.com> Cr-Commit-Position: refs/heads/main@{#1674242} NOKEYCHECK=True GitOrigin-RevId: 685d6eac6a9cd2eea74ea50589447ad809093634
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR hardens BMP V5 embedded ICC profile handling.
The decoder now validates the declared ICC profile byte range before allocating the profile buffer. It computes
profile_offset + profile_sizewith overflow checking, compares the result against the seekable input length, and returns anUnexpectedEof`` error if the profile extends beyond the file. The profile buffer allocation now also uses the crate’s fallible allocation helper instead of directvec![...]` allocation.A regression test was added for the Chromium issue 537617325 crash class. The test builds an in-memory 138-byte BMP V5 file with
bV5CSType == "MBED",bV5ProfileData == 0x90, andbV5ProfileSize == u32::MAX, then verifies that decoder construction fails withUnexpectedEofinstead of attempting to allocate the declared profile size.This fixes #3094