Security fixes from the Anvil audit (GHSA-57w8-h6pj-xx45)#411

Merged

boxerab merged 14 commits into

security/anvil-advisory-fixes

Jun 24, 2026

Commits on Jun 24, 2026

BMP: validate biSize before sizing the info-header read
Grok Compression
committed
BMP: bound RLE8/RLE4 input pointer to biSizeImage
Grok Compression
committed
JPEG: reject JPEGs with more than 3 output components
Grok Compression
committed
TIFF: reject contiguous data when numcomps != SamplesPerPixel
Grok Compression
committed
MJ2: validate sample offset/size against stream length
Grok Compression
committed
MJ2: bound STTS sample expansion by stream length
Grok Compression
committed
MJ2: null-check current_track_ in read_url/read_urn
Grok Compression
committed
MJ2: guard headerSize underflow in read_url/read_urn
Grok Compression
committed
tile-processor: keep Mct's tile pointer in sync to avoid UAF
Grok Compression
committed
decompress: size strip composite buffer for tallest tile-row
Grok Compression
committed
JP2: cap asoc superbox recursion depth
Grok Compression
committed
wavelet: guard inverse-DWT scratch pool allocation
Grok Compression
committed
PNM: size strip row bytes to the packer's byte width
Grok Compression
committed
HTJ2K: widen code-block data padding to 16 bytes
Grok Compression
committed