Zhixi Sun

يحتوي خادم واجهة برمجة تطبيقات Docker على مشكلة تسمح لعملاء واجهة برمجة التطبيقات المصرح لهم بتزويد تعبيرات نمطية (regular expressions) غير محدودة في أجسام طلبات نقطة النهاية '/crawl'. يمكن أن يؤدي ذلك إلى حدوث تراجع كارثي (catastrophic backtracking)—وهي حالة يستغرق فيها محرك التعبيرات النمطية وقتًا أسيًا لمعالجة إدخال معين—عند استخدام `RegexExtractionStrategy.custom` أو `RegexChunking.patterns` أو حقول التعبيرات النمطية في مخططات `JsonCss` و `JsonXPath` و `JsonLxml` ضد صفحة مصممة خصيصًا. قد يؤدي ذلك إلى تجميد الخادم بالكامل، بما في ذلك نقطة النهاية '/health'.

A flaw exists in the file-ico plugin when processing specially crafted ICO image files. The plugin fails to properly validate the `used clrs` (palette count) parameter, leading to improper memory bounds checking and a heap out-of-bounds read. This can result in an application crash, causing a denial of service or limited information disclosure of heap memory contents.

A flaw exists in the file-pvr plugin where the VQ (compressed) decoder fails to properly perform memory bounds checking when processing specially crafted PVR image files. This missing validation leads to a heap out-of-bounds read, which can cause the application to crash, resulting in a denial of service or limited disclosure of heap memory contents.

A flaw in the Seattle FilmWorks plugin occurs when processing a specially crafted SFW image file. The plugin allocates a Variable-Length Array (VLA)—an array whose size is determined at runtime—on the stack without performing integer overflow checks. This results in an unbounded stack allocation, leading to an application crash and a denial of service.

A flaw in the file-xwd plugin occurs when processing specially crafted XWD image files. The plugin validates image width and bytes-per-line parameters independently instead of ensuring their combined values align with the allocated buffer size. This improper bounds checking in the `load xwd f2 d1 b1()` and `load xwd f1 d24 b1()` functions leads to a heap out-of-bounds read, which is a condition where the program reads data past the end of the intended memory buffer. This can result in an application crash causing a denial of service or a limited information disclosure of heap memory contents into the resulting image.