From 800aaf45f6c8250e98599240bdca42c0409ed58d Mon Sep 17 00:00:00 2001 From: Vsevolod Stakhov Date: Thu, 23 Jul 2026 14:31:34 +0100 Subject: [PATCH] [Fix] html: correct image style dimension parsing The style dimension parser found a digit but called rspamd_strtoul from the start of the substring, ignored its return value, and assigned the result. For substrings longer than 22 chars rspamd_strtoul returns before writing *value, leaving img->height/width set from an uninitialized variable; shorter CSS parsed to zero because the substring began with ':' or whitespace. Parse the digit run starting at the located digit, bound the length to that run, and only assign on a successful parse. --- src/libserver/html/html.cxx | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/src/libserver/html/html.cxx b/src/libserver/html/html.cxx index 7af38a976..86972766f 100644 --- a/src/libserver/html/html.cxx +++ b/src/libserver/html/html.cxx @@ -1687,10 +1687,17 @@ html_process_img_tag(rspamd_mempool_t *pool, for (auto i = 0; i < substr.size(); i++) { auto t = substr[i]; if (g_ascii_isdigit(t)) { + /* Parse the digit run starting at this position */ + auto digit_end = i; + while (digit_end < substr.size() && + g_ascii_isdigit(substr[digit_end])) { + digit_end++; + } unsigned long val; - rspamd_strtoul(substr.data(), - substr.size(), &val); - img->height = val; + if (rspamd_strtoul(substr.data() + i, + digit_end - i, &val)) { + img->height = val; + } break; } else if (!g_ascii_isspace(t) && t != '=' && t != ':') { @@ -1710,10 +1717,17 @@ html_process_img_tag(rspamd_mempool_t *pool, for (auto i = 0; i < substr.size(); i++) { auto t = substr[i]; if (g_ascii_isdigit(t)) { + /* Parse the digit run starting at this position */ + auto digit_end = i; + while (digit_end < substr.size() && + g_ascii_isdigit(substr[digit_end])) { + digit_end++; + } unsigned long val; - rspamd_strtoul(substr.data(), - substr.size(), &val); - img->width = val; + if (rspamd_strtoul(substr.data() + i, + digit_end - i, &val)) { + img->width = val; + } break; } else if (!g_ascii_isspace(t) && t != '=' && t != ':') { -- 2.47.3