fastimage 2.4.1 → 2.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: acc5b0541538fa317b5401aa89c2c1f901d73b874d7f99465563ca30ee7cf724
-  data.tar.gz: 2c78d3222232b442f6f458341db19e9a52c14db32b9c65f10c18e67caeead9a7
+  metadata.gz: ccdbb1bae657d9c0e935422f1194986c5b78bcc23cdf3fcba4bd741f764a3d28
+  data.tar.gz: 88e8d78e8958a33d36fa887a01cb55083ca424919fceaf252760e81148022c44
 SHA512:
-  metadata.gz: 2eb212cb3768b60012066aaa9571e016d4ccb9ffec661560dcf7d7d20d39388313ee6b6a8ab66917d5b9334d905688795b9e50d97ff8375c95b82123f50216a3
-  data.tar.gz: 5967f9290bb98217ea92a0fa2199af9b140ce5ace7b49894dec65f05dda5eaaa115b66c53f0cdcaa0ef5d8984c20c0418dd346515c7e69e186813a71cfaffb59
+  metadata.gz: 839a15a2876f6855bbe4a7efdce3d1243dcc591c6962623f809a98582e753e085ce0bb409be726ede08f0cdfd6f438add649fdaddd20ac509dcdd6dd60b992a4
+  data.tar.gz: 0efd8b69909220e73f8f5683c8275af8040f1e61f5a2687cf097face9fa5ce14d6d5a3d46c10cceed96b2200cc98ecc4f363f5ca2a15a5f1cb16fa3344b9bd7c

data/lib/fastimage/fastimage_parsing/avif.rb

@@ -2,6 +2,7 @@ module FastImageParsing
   class Avif < ImageBase # :nodoc:  
     def dimensions
       bmff = IsoBmff.new(@stream)
+      return nil unless bmff.width && bmff.height
       [bmff.width, bmff.height]
     end
   

data/lib/fastimage/fastimage_parsing/fiber_stream.rb

@@ -13,8 +13,11 @@ module FastImageParsing
       @str = ''
     end
   
-    # Peeking beyond the end of the input will raise
+    # Peeking beyond the end of the input will raise. A negative length would
+    # move the cursor backwards, so treat it as unparseable data.
     def peek(n)
+      raise FastImage::CannotParseImage if n < 0
+
       while @strpos + n > @str.size
         unused_str = @str[@strpos..-1]
   
@@ -38,6 +41,8 @@ module FastImageParsing
     end
   
     def skip(n)
+      raise FastImage::CannotParseImage if n < 0
+
       discarded = 0
       fetched = @str[@strpos..-1].size
       while n > fetched

data/lib/fastimage/fastimage_parsing/heic.rb

@@ -2,6 +2,7 @@ module FastImageParsing
   class Heic < ImageBase # :nodoc:
     def dimensions
       bmff = IsoBmff.new(@stream)
+      return nil unless bmff.width && bmff.height
       [bmff.width, bmff.height]
     end
   end

data/lib/fastimage/fastimage_parsing/iso_bmff.rb

@@ -27,11 +27,11 @@ module FastImageParsing
         read_boxes!
       end
 
-      if [90, 270].include?(@rotation)
+      if @final_size && [90, 270].include?(@rotation)
         @final_size.reverse!
       end
-      
-      @width, @height = @final_size
+
+      @width, @height = @final_size if @final_size
     end
 
     private
@@ -153,8 +153,18 @@ module FastImageParsing
     def read_box_header!
       size = read_uint32!
       type = @stream.read(4)
-      size = read_uint64! - 8 if size == 1
-      [type, size - 8]
+      if size == 1
+        size = read_uint64!
+        throw :finish if size < 16
+        [type, size - 16]
+      else
+        # size == 0 means the box extends to end of file (ISO/IEC 14496-12 §4.2).
+        # size < 8 is malformed (smaller than the header itself). Either way, no
+        # further boxes can be parsed at this level, so stop rather than looping
+        # on a non-advancing skip.
+        throw :finish if size < 8
+        [type, size - 8]
+      end
     end
 
     def read_uint8!

data/lib/fastimage/fastimage_parsing/jxl.rb

@@ -6,6 +6,7 @@ module FastImageParsing
         [jxlc.width, jxlc.height]
       else
         bmff = IsoBmff.new(@stream)
+        return nil unless bmff.width && bmff.height
         [bmff.width, bmff.height]
       end
     end

data/lib/fastimage/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class FastImage
-  VERSION = '2.4.1'
+  VERSION = '2.4.3'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fastimage
 version: !ruby/object:Gem::Version
-  version: 2.4.1
+  version: 2.4.3
 platform: ruby
 authors:
 - Stephen Sykes
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-10 00:00:00.000000000 Z
+date: 2026-10-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fakeweb-fi