tiff: limit PackBits decompression output size

unpackBits has no output size limit. readBuf, which is used
for LZW, Deflate, and CCITT decompression, enforces a limit,
but the PackBits path bypasses readBuf entirely. This allows
a 2MB TIFF with PackBits compression to decompress to 745MB
(372x amplification).

CVE-2023-29408 added decompression size limits for other
formats but did not cover PackBits. This change adds a limit
parameter to unpackBits matching blockMaxDataSize, consistent
with the existing readBuf approach.

Updates golang/go#61582

Change-Id: I659f1da32bd415e4cf15a6061cb9ceee7a45f2af
GitHub-Last-Rev: 2e5fbdbb124d3f2d71ac5a204831dbaa2f8a77ce
GitHub-Pull-Request: golang/image#29
Reviewed-on: https://go-review.googlesource.com/c/image/+/759960
Auto-Submit: Damien Neil <dneil@google.com>
Reviewed-by: Nigel Tao <nigeltao@google.com>
Reviewed-by: Nigel Tao <nigeltao@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
3 files changed
tree: e47d8fba0c13d63cd1f18c87c22db8aafed912a4
  1. bmp/
  2. ccitt/
  3. cmd/
  4. colornames/
  5. draw/
  6. example/
  7. font/
  8. math/
  9. riff/
  10. testdata/
  11. tiff/
  12. vector/
  13. vp8/
  14. vp8l/
  15. webp/
  16. .gitattributes
  17. .gitignore
  18. codereview.cfg
  19. CONTRIBUTING.md
  20. go.mod
  21. go.sum
  22. LICENSE
  23. PATENTS
  24. README.md
README.md

Go Images

Go Reference

This repository holds supplementary Go image packages.

Report Issues / Send Patches

This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.

The git repository is https://go.googlesource.com/image.

The main issue tracker for the image repository is located at https://go.dev/issues. Prefix your issue with “x/image:” in the subject line, so it is easy to find.