GoSeverity: MediumStatus: Published

mimetype: CDF (OLE2) short-stream reader spends quadratic CPU on a crafted SSAT chain (DoS)

When detecting CDF files (doc, ppt, xls), the short-stream reader followed a short-sector chain until its output reached the size of the whole short-stream pool, not the stream’s declared length. Each step walked the SSAT sector chain from the start without caching or bounds. A small crafted file could make detection take quadratic time and use a lot of CPU, in any application that sniffs the type of uploaded bytes. Fixed in v1.4.16.