mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-08-22 12:12:18 -05:00
Mauandkolaente
d86af5c9b6
GetAvatar converted a caller-supplied size int64 directly to int via int(size) for imaging.Resize, with no check that the value was non-negative or within int's range. size traces back to an unauthenticated query parameter; on 32-bit builds a large int64 would silently truncate/wrap when narrowed, and a negative value would feed straight into the resize call. Reject out-of-range values before the conversion instead of letting it wrap silently.