tiff: limit PackBits decompression output size unpackBits has no output size limit. readBuf, which is used for LZW, Deflate, and CCITT decompression, enforces a limit, but the PackBits path bypasses readBuf entirely. This allows a 2MB TIFF with PackBits compression to decompress to 745MB (372x amplification). CVE-2023-29408 added decompression size limits for other formats but did not cover PackBits. This change adds a limit parameter to unpackBits matching blockMaxDataSize, consistent with the existing readBuf approach. Updates golang/go#61582 Change-Id: I659f1da32bd415e4cf15a6061cb9ceee7a45f2af GitHub-Last-Rev: 2e5fbdbb124d3f2d71ac5a204831dbaa2f8a77ce GitHub-Pull-Request: golang/image#29 Reviewed-on: https://go-review.googlesource.com/c/image/+/759960 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nigel Tao <nigeltao@google.com> Reviewed-by: Nigel Tao <nigeltao@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
This repository holds supplementary Go image packages.
This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.
The git repository is https://go.googlesource.com/image.
The main issue tracker for the image repository is located at https://go.dev/issues. Prefix your issue with “x/image:” in the subject line, so it is easy to find.