Fix DoS: infinite loop on zero-size boxes in HEIF/JXL parsers - #1
Open
jasonjul wants to merge 2 commits into
Open
Fix DoS: infinite loop on zero-size boxes in HEIF/JXL parsers#1jasonjul wants to merge 2 commits into
jasonjul wants to merge 2 commits into
Conversation
A crafted HEIF ispe box or JXL jxlp box with a zero-valued size field left the parser's scan offset unchanged, causing the containing while loop to spin forever and permanently block the event loop. Fixes GHSA-5p2g-fcmc-qvqq / CVE-2025-71329.
…boxes The zero-size guard only caught an exact 0; a declared size of 1-7 (smaller than the 8-byte box header) still advanced the offset by that tiny amount. The three call sites (findBox, HEIF's ispe scan, JXL's jxlp scan) duplicated the same guard independently, so the gap existed in all three. Factor the guard into a shared advanceBox helper that clamps to the header size.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ispebox or JXLjxlpbox with a zero-valued size field left the scan offset unchanged (offset = box.offset + box.size), so the containingwhileloop inheif.ts/jxl.tsnever advances and spins forever, permanently blocking the event loop.findBoxinutils.tsalready guards its own internal scan against zero-size boxes, but callers that additionally usebox.sizeto advance their own offset were not guarded. This applies the same "advance by at least 8 bytes" guard at those call sites.Test plan
specs/heif-jxl-dos.spec.tswith crafted HEIF/JXL buffers containing zero-size boxes; asserts the parser returns/throws instead of hanging.yarn testpasses with full coverage on both changed lines.yarn buildsucceeds.