From: Vsevolod Stakhov <vsevolod@rspamd.com>
Date: Thu, 23 Jul 2026 13:31:34 +0000 (+0100)
Subject: [Fix] html: correct image style dimension parsing
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;p=thirdparty%2Frspamd.git

[Fix] html: correct image style dimension parsing

The style dimension parser found a digit but called rspamd_strtoul from
the start of the substring, ignored its return value, and assigned the
result. For substrings longer than 22 chars rspamd_strtoul returns
before writing *value, leaving img->height/width set from an
uninitialized variable; shorter CSS parsed to zero because the substring
began with ':' or whitespace.

Parse the digit run starting at the located digit, bound the length to
that run, and only assign on a successful parse.
---

diff --git a/src/libserver/html/html.cxx b/src/libserver/html/html.cxx
index 7af38a976..86972766f 100644
--- a/src/libserver/html/html.cxx
+++ b/src/libserver/html/html.cxx
@@ -1687,10 +1687,17 @@ html_process_img_tag(rspamd_mempool_t *pool,
 				for (auto i = 0; i < substr.size(); i++) {
 					auto t = substr[i];
 					if (g_ascii_isdigit(t)) {
+						/* Parse the digit run starting at this position */
+						auto digit_end = i;
+						while (digit_end < substr.size() &&
+							   g_ascii_isdigit(substr[digit_end])) {
+							digit_end++;
+						}
 						unsigned long val;
-						rspamd_strtoul(substr.data(),
-									   substr.size(), &val);
-						img->height = val;
+						if (rspamd_strtoul(substr.data() + i,
+										   digit_end - i, &val)) {
+							img->height = val;
+						}
 						break;
 					}
 					else if (!g_ascii_isspace(t) && t != '=' && t != ':') {
@@ -1710,10 +1717,17 @@ html_process_img_tag(rspamd_mempool_t *pool,
 				for (auto i = 0; i < substr.size(); i++) {
 					auto t = substr[i];
 					if (g_ascii_isdigit(t)) {
+						/* Parse the digit run starting at this position */
+						auto digit_end = i;
+						while (digit_end < substr.size() &&
+							   g_ascii_isdigit(substr[digit_end])) {
+							digit_end++;
+						}
 						unsigned long val;
-						rspamd_strtoul(substr.data(),
-									   substr.size(), &val);
-						img->width = val;
+						if (rspamd_strtoul(substr.data() + i,
+										   digit_end - i, &val)) {
+							img->width = val;
+						}
 						break;
 					}
 					else if (!g_ascii_isspace(t) && t != '=' && t != ':') {