From a07481b416e0709cb03884592f3e93b4c83d4fd3 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Fri, 13 Nov 2026 06:27:24 -0500 Subject: [PATCH] Bound EXR pixel area and SVG image recursion --- crates/image-codecs/src/exr_stream.rs | 3 +++ crates/svg/src/tree/draw.rs | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/crates/image-codecs/src/exr_stream.rs b/crates/image-codecs/src/exr_stream.rs index 936814360..58c3bacc3 100644 --- a/crates/image-codecs/src/exr_stream.rs +++ b/crates/image-codecs/src/exr_stream.rs @@ -137,6 +137,9 @@ impl Decoder { if w == 0 || h == 0 || w > 1 << 18 || h > 1 << 18 { return Err(limit("EXR dimensions exceed the streaming limit of 262144")); } + if (w as u64).saturating_mul(h as u64) > 1 << 30 { + return Err(limit("EXR pixel count exceeds the streaming limit of 1073741824")); + } let list = &header.channels.list; if list.is_empty() || list.len() > 64 || list.iter().any(|c| c.sampling.0 != 1 || c.sampling.1 != 1) { return Err(unsupported("EXR channel count or subsampling")); diff --git a/crates/svg/src/tree/draw.rs b/crates/svg/src/tree/draw.rs index 2b5c40ca8..a7bdfd80f 100644 --- a/crates/svg/src/tree/draw.rs +++ b/crates/svg/src/tree/draw.rs @@ -39,7 +39,7 @@ const MAX_PATTERN_DEPTH: usize = 8; /// Embedded SVG images inside embedded SVG images. Each draws on a pixmap of the enclosing /// layer, which the live-bytes check charges, so deep chains of small images are harmless and /// chains of big ones stop at the budget long before this. -const MAX_IMAGE_DEPTH: usize = 32; +const MAX_IMAGE_DEPTH: usize = 24; /// Nested isolated groups, patterns, embedded images and filter images followed. It keeps this /// walk, and resvg's own recursion, far from a stack overflow; real drawings stay under a few dozen. const MAX_DEPTH: usize = 200;