Repository navigation
decoders: harden JPEG and FLAC against fuzzed input; patents section as open item - #10
Conversation
Continues the hardening that landed in PR #4. Each change rejects malformed input with an error or uses wrapping arithmetic where the value is unbounded by the format. Valid input is unchanged. jpeg: - Every length-bearing marker's segment must lie inside the input before its fields are read. SOF needs seven bytes and its component list must fit the segment; SOS needs its component list to fit; DRI reads are bounded. - DQT and DHT bound their reads against the segment end. - Sampling factors are 1..=4 (ITU-T T.81). - Entropy bits past the end of the scan read as zeros instead of underflowing the bit count. The bit count is clamped to 32, the Huffman symbol size is clamped to 16 in EXTEND, and the received value is masked to that size. - The DC predictor uses wrapping arithmetic. flac: - The unary code loop stops at the end of the input. - The metadata loop stops past the end of the input. - A wasted-bits count at or above the sample width is an error. - A frame whose channel count differs from STREAMINFO is an error. - A predictor order larger than its partition is an error, and a block size not divisible by the partition count is an error. - Predictor arithmetic wraps. tests/fuzz_regressions.rs embeds each reproducing input and runs the decoder on a worker thread with a deadline. A panic, a hang or an abort fails the test. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ch6Crfubj3FwdxR7ywn9vT
README.md carries the patents and licensing section, and docs/OPENSSF.md carries it as the open item. The text is unresolved: it says the crate must not be described as patent-free, and that maintainers need counsel's decision before it is distributed. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ch6Crfubj3FwdxR7ywn9vT
|
The Dependency review check failed on head This PR changes no dependency manifests or lockfiles, so there is nothing for the check to review. No code change in this PR fixes it. I have not re-run the job, because a re-run would fail the same way while the setting is off. The other checks on this PR (format, clippy, tests) pass locally on the same commit. Generated by Claude Code |
|
The CodeQL (Rust) check failed on head No code change in this PR fixes this. I have not re-run the job, because the upload would be refused again while the setting is off. Generated by Claude Code |
The patents and licensing section no longer reads as an open decision. The crate is published under Apache-2.0 with no patent search or counsel review, and the README states that and says users must check the position that applies to them. The section no longer tells readers the crate must not be distributed, and it makes no claim that the crate is patent-free. Claude-Session: https://claude.ai/code/session_01Ch6Crfubj3FwdxR7ywn9vT
The README and docs/STANDARDS.md now say what the licence covers, which formats are in patent pools, and that publishing source does not license third-party patents. The counsel review gate is removed. Every module stays published. The Source check column records which rows were read only in secondary sources. Claude-Session: https://claude.ai/code/session_01Ch6Crfubj3FwdxR7ywn9vT
Summary
Follow-up to the merged #4. The fuzzing targets found crashes in the JPEG and FLAC decoders on untrusted input. This PR fixes them, adds regression tests, and adds the patents and licensing section as an open item.
7bde2eddecoders: JPEG and FLAC hardening, with 21 regression tests intests/fuzz_regressions.rs.4d1e1efdocs: the patents and licensing section, as an open item inREADME.mdanddocs/OPENSSF.md.Open items
Checks
cargo fmt --checkcargo clippy --all-targets --locked -- -D warningscargo test --locked --no-fail-fast🤖 Generated with Claude Code