Add advisory for ithmb-core < 1.9.5 (progressive-JPEG OOM + PhotoDB infinite loop)

[B67687]

Advisory

New advisory for ithmb-core (published by B67687/Ithmb-Codec): two denial-of-service vulnerabilities reachable from untrusted input, fixed in 1.9.5.

1. CWE-400: crafted progressive JPEG (SOF2 65535x65535) triggers ~8 GiB coefficient allocation before any size check → deterministic SIGABRT. Root cause is in jpeg_decoder 0.3.2 (allocates during first SOS, before its buffer-limit check at EOI); fix is a read_info() pre-flight rejection using a w*h*11 byte budget.
2. CWE-835: crafted PhotoDB container with mhii total_len==0 makes the chunk walker spin at 100% CPU forever; fix is a child_end <= pos bail-out.

Both were found via security research with working PoCs (166-byte and 24-byte fixtures). Filed by the crate author.

Note

All crates.io versions prior to 1.9.5 were permanently deleted from the registry, so the practical exposure is limited to existing lockfiles and vendored copies — but cargo audit should still flag them.

[Copilot]

Pull request overview

Adds a new RustSec advisory entry for ithmb-core describing two untrusted-input denial-of-service issues fixed in >= 1.9.5 (progressive JPEG-triggered OOM and a PhotoDB chunk-walker infinite loop).

Changes:

• Introduces a new advisory markdown file for ithmb-core with TOML front matter and detailed vulnerability write-up.
• Documents triggers, impact, and fixes for the two reported DoS vulnerabilities.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[djc]

You didn't use the pull request template, and this crate doesn't seem to be listed on crates.io at all.