mirrors/fdroidserver
1
0
Fork 0
mirror of https://github.com/f-droid/fdroidserver.git synced 2025-10-07 01:41:06 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

update: max image size of 16 mil pixels to stop image bomb attacks

Browse source 
closes #555
This commit is contained in:
Hans-Christoph Steiner 2018-09-05 20:36:37 +02:00
parent 0cd1e0b172
commit 3ab66efcfe
1 changed files with 6 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
fdroidserver/update.py
View file

@ -23,8 +23,10 @@ import sys
import os import os
import shutil import shutil
import glob import glob
import logging
import re import re
import socket import socket
import warnings
import zipfile import zipfile
import hashlib import hashlib
import json import json
@ -36,9 +38,6 @@ from argparse import ArgumentParser
import collections import collections
from binascii import hexlify from binascii import hexlify
from PIL import Image, PngImagePlugin
import logging
from . import _ from . import _
from . import common from . import common
from . import index from . import index
@ -46,6 +45,10 @@ from . import metadata
from .common import SdkToolsPopen from .common import SdkToolsPopen
from .exception import BuildException, FDroidException from .exception import BuildException, FDroidException
from PIL import Image, PngImagePlugin
warnings.simplefilter('error', Image.DecompressionBombWarning)
Image.MAX_IMAGE_PIXELS = 0xffffff # 4096x4096
METADATA_VERSION = 20 METADATA_VERSION = 20
# less than the valid range of versionCode, i.e. Java's Integer.MIN_VALUE # less than the valid range of versionCode, i.e. Java's Integer.MIN_VALUE