DngEncoder::with_c2pa_reserved(len) is an infallible builder (crates/gamut-dng/src/encoder.rs:214), and the length it stores reaches vec![0; len] unchecked at encoder.rs:237. Past isize::MAX that panics with a capacity overflow instead of returning, so a caller's number turns into a panic out of a library path.
The identical defect was fixed this round in the other two container crates of the C2PA epic (#239), both with the same shape — refuse at the encode, since the builder cannot fail, before the reservation is allocated:
gamut-avif: refuses a length below the 8-byte JUMBF box header and one the framing cannot hold.gamut-tiff: refuses below the store minimum (8, or 9 in BigTIFF) and above the smaller of what a buffer holds (isize::MAX) and what the container's count and offset words describe (u32::MAX classic, 64-bit BigTIFF).
gamut-dng already shares gamut_ifd::c2pa's placement rules with gamut-tiff, so the same two bounds apply to it unchanged — a DNG is a TIFF/EP profile over the same IFD container. Filed rather than fixed in place because crates/gamut-dng/ belongs to a different, unmerged pull request (#508 / #442), and reaching into it from the gamut-tiff branch would cross a pull-request boundary.
Suggested acceptance: a len of usize::MAX (and one past each variant's own bound) is refused as Error::InvalidInput on every encode entry point, asserted on the message rather than is_err, with no allocation and no panic; the three crates' refusals say the same thing about the same input.
Refs #239, #442, #446.
DngEncoder::with_c2pa_reserved(len)is an infallible builder (crates/gamut-dng/src/encoder.rs:214), and the length it stores reachesvec![0; len]unchecked atencoder.rs:237. Pastisize::MAXthat panics with a capacity overflow instead of returning, so a caller's number turns into a panic out of a library path.The identical defect was fixed this round in the other two container crates of the C2PA epic (#239), both with the same shape — refuse at the encode, since the builder cannot fail, before the reservation is allocated:
gamut-avif: refuses a length below the 8-byte JUMBF box header and one the framing cannot hold.gamut-tiff: refuses below the store minimum (8, or 9 in BigTIFF) and above the smaller of what a buffer holds (isize::MAX) and what the container's count and offset words describe (u32::MAXclassic, 64-bit BigTIFF).gamut-dngalready sharesgamut_ifd::c2pa's placement rules withgamut-tiff, so the same two bounds apply to it unchanged — a DNG is a TIFF/EP profile over the same IFD container. Filed rather than fixed in place becausecrates/gamut-dng/belongs to a different, unmerged pull request (#508 / #442), and reaching into it from the gamut-tiff branch would cross a pull-request boundary.Suggested acceptance: a
lenofusize::MAX(and one past each variant's own bound) is refused asError::InvalidInputon every encode entry point, asserted on the message rather thanis_err, with no allocation and no panic; the three crates' refusals say the same thing about the same input.Refs #239, #442, #446.