Zhixi Sun

The Docker API server contains an issue where authenticated API clients can provide unbounded regular expressions in the '/crawl' endpoint request bodies. This can lead to catastrophic backtracking—a condition where a regular expression engine takes an exponential amount of time to process a specific input—when using `RegexExtractionStrategy.custom`, `RegexChunking.patterns`, or the regex fields within `JsonCss`, `JsonXPath`, and `JsonLxml` schemas against a specially crafted page. This can result in the entire server freezing, including the '/health' endpoint.

A flaw exists in the file-ico plugin when processing specially crafted ICO image files. The plugin fails to properly validate the `used clrs` (palette count) parameter, leading to improper memory bounds checking and a heap out-of-bounds read. This can result in an application crash, causing a denial of service or limited information disclosure of heap memory contents.

A flaw exists in the file-pvr plugin where the VQ (compressed) decoder fails to properly perform memory bounds checking when processing specially crafted PVR image files. This missing validation leads to a heap out-of-bounds read, which can cause the application to crash, resulting in a denial of service or limited disclosure of heap memory contents.

A flaw in the Seattle FilmWorks plugin occurs when processing a specially crafted SFW image file. The plugin allocates a Variable-Length Array (VLA)—an array whose size is determined at runtime—on the stack without performing integer overflow checks. This results in an unbounded stack allocation, leading to an application crash and a denial of service.

A flaw in the file-xwd plugin occurs when processing specially crafted XWD image files. The plugin validates image width and bytes-per-line parameters independently instead of ensuring their combined values align with the allocated buffer size. This improper bounds checking in the `load xwd f2 d1 b1()` and `load xwd f1 d24 b1()` functions leads to a heap out-of-bounds read, which is a condition where the program reads data past the end of the intended memory buffer. This can result in an application crash causing a denial of service or a limited information disclosure of heap memory contents into the resulting image.