mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-11-09 00:22:38 -06:00
kolaente
27ec08bb03
Images longer than MaxSide (65535) pixels on either side are now rejected before decoding, like images over the pixel limit. Attachments with such images are still stored; only their preview is not generated. Project backgrounds and avatars reject them with the existing image too large error.
39 lines
1.4 KiB
Go
39 lines
1.4 KiB
Go
// Vikunja is a to-do list application to facilitate your life.
|
|
// Copyright 2018-present Vikunja and contributors. All rights reserved.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
|
|
package imageutils
|
|
|
|
import (
|
|
"image"
|
|
)
|
|
|
|
// MaxPixels bounds allocations from attacker-controlled dimensions.
|
|
const MaxPixels = 50_000_000 // 50 megapixels
|
|
|
|
// MaxSide bounds resampling memory, which grows with the longer side; it equals JPEG's own limit.
|
|
const MaxSide = 65_535
|
|
|
|
// Division avoids overflow from multiplying hostile dimensions.
|
|
func ValidateConfig(cfg image.Config) error {
|
|
if cfg.Width <= 0 || cfg.Height <= 0 {
|
|
return &ErrImageTooLarge{Width: cfg.Width, Height: cfg.Height}
|
|
}
|
|
if cfg.Width > MaxSide || cfg.Height > MaxSide || cfg.Width > MaxPixels/cfg.Height {
|
|
return &ErrImageTooLarge{Width: cfg.Width, Height: cfg.Height}
|
|
}
|
|
return nil
|
|
}
|