From 42bcff666855ab978e67a9041d0cdea552f20301 Mon Sep 17 00:00:00 2001
From: Helena Mariano <31138349+helenamariano@users.noreply.github.com>
Date: Mon, 18 Jul 2022 15:47:08 +1000
Subject: [PATCH] fix unbounded memory consumption vulnerability (#111)

Co-authored-by: Helena Mariano <31138349+helenamariano@users.noreply.github.com>
---
 docx.go  | 2 +-
 limit.go | 3 +++
 odt.go   | 2 +-
 pages.go | 2 +-
 xml.go   | 4 ++--
 5 files changed, 8 insertions(+), 5 deletions(-)
 create mode 100644 limit.go

diff --git a/docx.go b/docx.go
index 0b3c2e6..f9f276a 100644
--- a/docx.go
+++ b/docx.go
@@ -40,7 +40,7 @@ func ConvertDocx(r io.Reader) (string, map[string]string, error) {
 		size = si.Size()
 		ra = f
 	} else {
-		b, err := ioutil.ReadAll(r)
+		b, err := ioutil.ReadAll(io.LimitReader(r, maxBytes))
 		if err != nil {
 			return "", nil, nil
 		}
diff --git a/limit.go b/limit.go
new file mode 100644
index 0000000..8ef2940
--- /dev/null
+++ b/limit.go
@@ -0,0 +1,3 @@
+package docconv
+
+const maxBytes = 20 << 20 // 20MB
diff --git a/odt.go b/odt.go
index 68dd968..ad93d07 100644
--- a/odt.go
+++ b/odt.go
@@ -14,7 +14,7 @@ func ConvertODT(r io.Reader) (string, map[string]string, error) {
 	meta := make(map[string]string)
 	var textBody string
 
-	b, err := ioutil.ReadAll(r)
+	b, err := ioutil.ReadAll(io.LimitReader(r, maxBytes))
 	if err != nil {
 		return "", nil, err
 	}
diff --git a/pages.go b/pages.go
index 5325ecf..54a2b03 100644
--- a/pages.go
+++ b/pages.go
@@ -21,7 +21,7 @@ func ConvertPages(r io.Reader) (string, map[string]string, error) {
 	meta := make(map[string]string)
 	var textBody string
 
-	b, err := ioutil.ReadAll(r)
+	b, err := ioutil.ReadAll(io.LimitReader(r, maxBytes))
 	if err != nil {
 		return "", nil, fmt.Errorf("error reading data: %v", err)
 	}
diff --git a/xml.go b/xml.go
index 8f422a3..28da02e 100644
--- a/xml.go
+++ b/xml.go
@@ -25,7 +25,7 @@ func ConvertXML(r io.Reader) (string, map[string]string, error) {
 func XMLToText(r io.Reader, breaks []string, skip []string, strict bool) (string, error) {
 	var result string
 
-	dec := xml.NewDecoder(r)
+	dec := xml.NewDecoder(io.LimitReader(r, maxBytes))
 	dec.Strict = strict
 	for {
 		t, err := dec.Token()
@@ -76,7 +76,7 @@ func XMLToText(r io.Reader, breaks []string, skip []string, strict bool) (string
 // XMLToMap converts XML to a nested string map.
 func XMLToMap(r io.Reader) (map[string]string, error) {
 	m := make(map[string]string)
-	dec := xml.NewDecoder(r)
+	dec := xml.NewDecoder(io.LimitReader(r, maxBytes))
 	var tagName string
 	for {
 		t, err := dec.Token()