[PR #4353] [MERGED] Limit uploaded avatar image-size to 4096x3072 by default #17341

New Issue

GiteaMirror · 2025-11-02T12:33:01-06:00

GiteaMirror commented

2025-11-02 12:33:01 -06:00

📋 Pull Request Information

Original PR: https://github.com/go-gitea/gitea/pull/4353
Author: @bkcsoft
Created: 7/2/2018
Status: ✅ Merged
Merged: 7/3/2018
Merged by: @lafriks

Base: master ← Head: fix-image-dos-attack

📝 Commits (2)

296c153 Limit uploaded avatar image-size to 4096x3072 by default
cb69ac8 Delete unneeded file

📊 Changes

3 files changed (+19 additions, -0 deletions)

View changed files

📝 custom/conf/app.ini.sample (+4 -0)
📝 models/user.go (+11 -0)
📝 modules/setting/setting.go (+4 -0)

📄 Description

Uploading large files may cause Gitea to crash on OOM. This load the image-header first and checks the sizes before proceeding.

(e.g. a 64250x64250 image becomes 4.1 Gigapixels. Which would allocate 16GB of RAM in RGBA8888.)

Since this can be used for DoS-attacks we should backport it. Just don't know which version yet 🙂

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-gitea/gitea/pull/4353 **Author:** [@bkcsoft](https://github.com/bkcsoft) **Created:** 7/2/2018 **Status:** ✅ Merged **Merged:** 7/3/2018 **Merged by:** [@lafriks](https://github.com/lafriks) **Base:** `master` ← **Head:** `fix-image-dos-attack` --- ### 📝 Commits (2) - [`296c153`](https://github.com/go-gitea/gitea/commit/296c1533e7d223f9cb819431c410a5fd6ae89c44) Limit uploaded avatar image-size to 4096x3072 by default - [`cb69ac8`](https://github.com/go-gitea/gitea/commit/cb69ac88c82d92d6c633a0009ab085db854a32d9) Delete unneeded file ### 📊 Changes **3 files changed** (+19 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `custom/conf/app.ini.sample` (+4 -0) 📝 `models/user.go` (+11 -0) 📝 `modules/setting/setting.go` (+4 -0) </details> ### 📄 Description Uploading large files may cause Gitea to crash on OOM. This load the image-header first and checks the sizes before proceeding. (e.g. a 64250x64250 image becomes 4.1 Gigapixels. Which would allocate 16GB of RAM in RGBA8888.) Since this can be used for DoS-attacks we should backport it. Just don't know which version yet :slightly_smiling_face: --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-02 12:33:01 -06:00

GiteaMirror closed this issue

2025-11-02 12:33:01 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#17341