Bound EXR pixel area and SVG image recursion

crates/image-codecs/src/exr_stream.rs

@@ -137,6 +137,9 @@ impl<R: Read + Seek> Decoder<R> {
         if w == 0 || h == 0 || w > 1 << 18 || h > 1 << 18 {
             return Err(limit("EXR dimensions exceed the streaming limit of 262144"));
         }
+        if (w as u64).saturating_mul(h as u64) > 1 << 30 {
+            return Err(limit("EXR pixel count exceeds the streaming limit of 1073741824"));
+        }
         let list = &header.channels.list;
         if list.is_empty() || list.len() > 64 || list.iter().any(|c| c.sampling.0 != 1 || c.sampling.1 != 1) {
             return Err(unsupported("EXR channel count or subsampling"));

crates/svg/src/tree/draw.rs

@@ -39,7 +39,7 @@ const MAX_PATTERN_DEPTH: usize = 8;
 /// Embedded SVG images inside embedded SVG images. Each draws on a pixmap of the enclosing
 /// layer, which the live-bytes check charges, so deep chains of small images are harmless and
 /// chains of big ones stop at the budget long before this.
-const MAX_IMAGE_DEPTH: usize = 32;
+const MAX_IMAGE_DEPTH: usize = 24;
 /// Nested isolated groups, patterns, embedded images and filter images followed. It keeps this
 /// walk, and resvg's own recursion, far from a stack overflow; real drawings stay under a few dozen.
 const MAX_DEPTH: usize = 200;