Skip to content

Omostrich 0.3.2

Choose a tag to compare

View all tags
@ninepointlabs ninepointlabs released this 27 Oct 13:33
v0.3.2
b71cf7e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's fixed

  • The cached profile picture is now stripped to pixels only. 0.3.1 limited the picture's download size and pixel dimensions, but the cached file could still carry compressed metadata chunks (such as PNG zTXt/iTXt/iCCP). Qt and libpng expand those while reading the header, so a small hostile picture could push the panel to several GB of memory. The daemon now rewrites the downloaded picture to an allowlist of the parts needed to draw it, with no re-encoding and no new dependency. Reported in marketplace review #12494.
    • PNG: keeps IHDR, PLTE, tRNS, gAMA, cHRM, sRGB, IDAT and IEND, and drops every other ancillary chunk. An unknown critical chunk is refused.
    • JPEG: keeps the coding segments, JFIF and Adobe, and drops COM, EXIF, ICC, XMP and Photoshop data.
    • GIF: keeps the first frame only, with no comment or application extensions.
    • WebP: keeps the image data (plus alpha) and drops ICC, EXIF, XMP and unknown chunks. Animated WebP is refused, so the placeholder shows.
    • Bytes after the end of the image are dropped for every format.
  • A picture cached by 0.3.1 is ignored on startup and fetched again, so the cache only ever holds the stripped copy.

Install / update

cd ~/Projects/omostrich
git pull
npm ci
./install-daemon.sh
./install-plugin.sh
systemctl --user restart omostrich   # the running daemon keeps the old code until restarted

Full Changelog: v0.3.1...v0.3.2

Assets 2
Loading