| 제목 | SMG Project (smg-project) Shepherd Model Gateway (SMG), llm-multimodal Rust crate v1.7.0, v1.8.0, v1.9.0, v1.10.0, and v1.10.1 Memory Allocation with Excessive Size Value |
|---|
| 설명 | An excessive memory allocation vulnerability in the llm-multimodal component of Shepherd Model Gateway (SMG) allows an attacker who can supply an image to the affected JPEG decoding path to cause excessive memory consumption and processing delays, potentially resulting in denial of service. The vulnerability is present in release tags v1.7.0, v1.8.0, v1.9.0, v1.10.0, and v1.10.1.
When libjpeg-turbo is available at runtime, jpeg_turbo::decode_jpeg_rgb allocates an RGB output buffer based on dimensions obtained from the untrusted JPEG header. The size calculation checks for integer overflow but does not enforce a maximum decoded-image size. Consequently, a small malformed image can cause a large buffer to be allocated and written before decoding fails. The public report documents approximately 12 GiB of peak resident memory and tens of seconds of processing for a sub-kilobyte input. Rejecting the image after decoding does not prevent this resource consumption.
The issue affects deployments that process untrusted images through this decoding path with libjpeg-turbo available. SMG v1.11.0 includes a fix that enforces a 512 MiB decoded-buffer limit before allocation, implemented in commit 8f51b57e219a914089e345b704c3c8de37a3bb8e. |
|---|
| 원천 | ⚠️ https://github.com/smg-project/smg/issues/2361 |
|---|
| 사용자 | Zyz3366 (UID 97230) |
|---|
| 제출 | 2026. 09. 25. PM 05:45 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 25. AM 07:41 (30 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 426162 [smg-project smg 까지 1.10.1 llm-multimodal jpeg_turbo.rs decode_jpeg_rgb 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|