mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-18 21:25:20 +02:00
卢文彬andDeepSeek
6b9e173477
The archive limits bound what one import extracts (256 MiB an entry, 1 GiB in total), and one pixel layer is skipped past 64 megapixels, but nothing bounded what the layers materialized out of that cost: each bitmap's declared `BmpW`/`BmpH` sizes its RGBA output and its decode planes, with or without tile data, so a small document with many layers could still allocate without end. `Limits` gains `max_pixel_bytes` (1 GiB by default, the budget the other importers allow decoded pixels). `Reader` admits a layer before `decode` allocates it: the layer's RGBA joins the layers already materialized, and its working planes are counted with them, since every earlier layer is still live while this one decodes. Past the budget the import fails with `Error::Limit`, which `photocraft-io` reports and falls back from to the embedded preview. Tests: a synthetic 300-byte document declaring layers with no tiles at all - one layer inside the budget imports, the second past it is rejected before allocation, and a declared 2048x2048 layer is rejected under a 1 MiB budget. The fuzz targets get a small pixel budget so mutations reach the new rejection path. Co-authored-by: DeepSeek <noreply@deepseek.com>