Medium, CVSS 4.3crates.ioAmendedPublished
oxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)
GHSA-88q9-cmp2-c2vq
- Affected
- crates.io oxidize-pdf <= 2.5.7
- Fixed in
- 2.6.0· Vendor fix available
- Issue
- Impact oxidize-pdf defines Color as a pub enum with public tuple-struct variants Rgb(f64, f64, f64), Gray(f64), and Cmyk(f64, f64, f64, f64). The constructors Color::rgb, Color::gray, and Color::cmyk clamp incoming components to [0.0, 1.0], but because the variants are pub, callers can construct values directly without going through the constructors: rust let safe = Color::rgb(f64::NAN, 0.5, 0.5); // clamps NaN to 0.0 let attack = Color::Rgb(f64::NAN, 0.5, 0.5); // bypasses clamp Color: Copy allows the non-finite value to propagate freely through API surfaces and serialisation. When such a value reaches a content-stream emitter, the writer formats it via format!("{:.3}", v). The Rust standard library renders f64::NAN as "NaN", f64::INFINITY as "inf", and f64::NEGINFINITY as "-inf" — none of which are valid PDF numeric tokens per ISO 32000-1 §7.3.3: ▎ A numeric object shall be represented by one or more decimal digits with an optional sign and a leading, trailing, or embedded PERIOD.…
Recommended action: Upgrade to 2.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.