This is an automated email from the git hooks/post-receive script.
git pushed a commit to branch master
in repository legacy-imlib2.
View the commit online.
commit 130f118f653e12a2b855a4b6dd35a87968f6d128
Author: Acts1631 <[email protected]>
AuthorDate: Fri Aug 21 18:47:15 2026 -0400
j2k: limit decoded image dimensions
The JPEG 2000 loader passed header dimensions directly to OpenJPEG
before applying the library image limit. A small crafted file could
request excessive decoder allocations.
Reject dimensions outside IMAGE_DIMENSIONS_OK before header success
or decoding.
---
src/modules/loaders/loader_j2k.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/modules/loaders/loader_j2k.c b/src/modules/loaders/loader_j2k.c
index 4420a58..e22381b 100644
--- a/src/modules/loaders/loader_j2k.c
+++ b/src/modules/loaders/loader_j2k.c
@@ -172,6 +172,8 @@ _load(ImlibImage *im, int load_data)
im->w = jimage->x1 - jimage->x0;
im->h = jimage->y1 - jimage->y0;
im->has_alpha = jimage->numcomps == 4 || jimage->numcomps == 2;
+ if (!IMAGE_DIMENSIONS_OK(im->w, im->h))
+ goto quit;
D("WxH=%dx%d alpha=%d numcomp=%d colorspace=%d\n",
im->w, im->h, im->has_alpha, jimage->numcomps, jimage->color_space);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
