qr: cap image dimensions and allocation

1 files changed, 12 insertions, 2 deletions

diff --git a/src/commands/qr.rs b/src/commands/qr.rs
index c0b8af0..611f43f 100644
--- a/src/commands/qr.rs
+++ b/src/commands/qr.rs
@@ -61,10 +61,20 @@ pub async fn dekodowanie(
         .await?
         .bytes()
         .await?;
-    // Decoding is CPU-heavy: keep it off the async runtime.
+    // Decoding is CPU-heavy: keep it off the async runtime, and cap the
+    // dimensions/allocation so a small compressed image cannot expand into
+    // gigabytes of pixels.
     let img_data = img_data.to_vec();
     let decoded = tokio::task::spawn_blocking(move || {
-        let img = image::load_from_memory(&img_data).ok()?;
+        let mut reader = image::ImageReader::new(std::io::Cursor::new(&img_data))
+            .with_guessed_format()
+            .ok()?;
+        let mut limits = image::Limits::default();
+        limits.max_image_width = Some(5_000);
+        limits.max_image_height = Some(5_000);
+        limits.max_alloc = Some(128 * 1024 * 1024);
+        reader.limits(limits);
+        let img = reader.decode().ok()?;
         let gray = img.to_luma8();
         decode_qr_simple(&gray)
     })