nuxt-og-image 7.0.4 → 7.0.6

package/dist/module.json

@@ -4,7 +4,7 @@
     "nuxt": "^4.6.1 || ^5.0.0-0"
   },
   "configKey": "ogImage",
-  "version": "7.0.4",
+  "version": "7.0.6",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/runtime/server/og-image/font-binary.d.ts

@@ -16,6 +16,7 @@ export type FontBinaryResult = {
 export declare function isWoff2Binary(source: BufferSource): boolean;
 /**
  * Parse loaded font bytes into a binary that every Takumi build accepts.
- * TTF, OTF, font collections and WOFF2 pass through; WOFF inflates to TTF or OTF.
+ * Check TTF, OTF and collection table bounds, plus WOFF2 header and file length.
+ * Accepted bytes pass through; WOFF inflates to TTF or OTF.
  */
 export declare function parseFontBinary(source: BufferSource): Promise<FontBinaryResult>;

package/dist/runtime/server/og-image/font-binary.js

@@ -2,6 +2,9 @@ const WOFF_HEADER_SIZE = 44;
 const WOFF_TABLE_ENTRY_SIZE = 20;
 const SFNT_TABLE_RECORD_SIZE = 16;
 const MAX_SFNT_SIZE = 64 * 1024 * 1024;
+function alignTableSize(size) {
+  return Math.ceil(size / 4) * 4;
+}
 const SIGNATURES = {
   truetype: 65536,
   appleTrueType: 1953658213,
@@ -25,6 +28,61 @@ function readSignature(data) {
     return void 0;
   return new DataView(data.buffer, data.byteOffset, data.byteLength).getUint32(0);
 }
+function sfntError(data, offset = 0) {
+  if (offset + 12 > data.byteLength)
+    return "the SFNT header is truncated";
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  const signature = view.getUint32(offset);
+  if (signature !== SIGNATURES.truetype && signature !== SIGNATURES.appleTrueType && signature !== SIGNATURES.openType)
+    return "the SFNT signature is invalid";
+  const numTables = view.getUint16(offset + 4);
+  if (numTables === 0)
+    return "the SFNT file has no tables";
+  if (offset + 12 + numTables * SFNT_TABLE_RECORD_SIZE > data.byteLength)
+    return "the SFNT table directory is truncated";
+  for (let index = 0; index < numTables; index++) {
+    const record = offset + 12 + index * SFNT_TABLE_RECORD_SIZE;
+    if (view.getUint32(record + 8) + view.getUint32(record + 12) > data.byteLength)
+      return "an SFNT table runs past the end of the file";
+  }
+}
+function collectionError(data) {
+  if (data.byteLength < 12)
+    return "the font collection header is truncated";
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  const version = view.getUint32(4);
+  if (version !== 65536 && version !== 131072)
+    return "the font collection version is invalid";
+  const numFonts = view.getUint32(8);
+  if (numFonts === 0)
+    return "the font collection has no fonts";
+  const headerSize = 12 + numFonts * 4 + (version === 131072 ? 12 : 0);
+  if (headerSize > data.byteLength)
+    return "the font collection directory is truncated";
+  for (let index = 0; index < numFonts; index++) {
+    const offset = view.getUint32(12 + index * 4);
+    if (offset < headerSize)
+      return "a font collection offset overlaps its header";
+    const error = sfntError(data, offset);
+    if (error)
+      return error;
+  }
+}
+function woff2Error(data) {
+  if (data.byteLength < 48)
+    return "the WOFF2 header is truncated";
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  if (view.getUint32(8) !== data.byteLength)
+    return "the WOFF2 length does not match the file";
+  if (view.getUint16(12) === 0)
+    return "the WOFF2 file has no tables";
+  const compressedSize = view.getUint32(20);
+  if (compressedSize === 0 || compressedSize > data.byteLength - 48)
+    return "the WOFF2 compressed data is missing or truncated";
+}
+function checked(data, error) {
+  return error ? { _tag: "Err", reason: error } : { _tag: "Ok", data };
+}
 async function inflate(data, size) {
   const output = new Uint8Array(size);
   const reader = new Blob([data]).stream().pipeThrough(new DecompressionStream("deflate")).getReader();
@@ -71,10 +129,10 @@ async function decodeWoff(woff) {
       throw new Error("a WOFF table runs past the end of the file");
     if (table.compLength > table.origLength)
       throw new Error("a WOFF table is larger than its decoded size");
-    sfntSize += table.origLength + 3 & ~3;
+    sfntSize += alignTableSize(table.origLength);
+    if (sfntSize > MAX_SFNT_SIZE)
+      throw new Error(`the decoded font exceeds ${MAX_SFNT_SIZE} bytes`);
   }
-  if (sfntSize > MAX_SFNT_SIZE)
-    throw new Error(`the decoded font exceeds ${MAX_SFNT_SIZE} bytes`);
   const tableData = await Promise.all(tables.map((table) => {
     const stored = woff.subarray(table.offset, table.offset + table.compLength);
     return table.compLength < table.origLength ? inflate(stored, table.origLength) : stored;
@@ -96,7 +154,7 @@ async function decodeWoff(woff) {
     out.setUint32(record + 8, offset);
     out.setUint32(record + 12, table.origLength);
     sfnt.set(tableData[index], offset);
-    offset += table.origLength + 3 & ~3;
+    offset += alignTableSize(table.origLength);
   });
   return sfnt;
 }
@@ -109,12 +167,14 @@ export async function parseFontBinary(source) {
     case SIGNATURES.truetype:
     case SIGNATURES.appleTrueType:
     case SIGNATURES.openType:
+      return checked(data, sfntError(data));
     case SIGNATURES.collection:
+      return checked(data, collectionError(data));
     case SIGNATURES.woff2:
-      return { _tag: "Ok", data };
+      return checked(data, woff2Error(data));
     case SIGNATURES.woff:
       return decodeWoff(data).then(
-        (sfnt) => ({ _tag: "Ok", data: sfnt }),
+        (sfnt) => checked(sfnt, sfntError(sfnt)),
         (error) => ({ _tag: "Err", reason: `it is a WOFF file that could not be decoded: ${error.message}` })
       );
     default:

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-og-image",
   "type": "module",
-  "version": "7.0.4",
+  "version": "7.0.6",
   "description": "Enlightened OG Image generation for Nuxt.",
   "author": {
     "website": "https://harlanzw.com",