image.go RawHistoryFolder

1// Package image provides bounded standard-library raster image ingestion.
2package image
3
4import (
5	"bytes"
6	"errors"
7	"image"
8	_ "image/jpeg"
9	_ "image/png"
10)
11
12// MaxPixels caps decoded pixel count, preventing unexpectedly large allocations.
13const MaxPixels = 16 * 1024 * 1024
14
15var ErrSize = errors.New("image: invalid or excessive dimensions")
16
17// Size validates dimensions of an already decoded image. Its owner retains the image.
18func Size(src image.Image) (width, height int, err error) {
19	if src == nil {
20		return 0, 0, ErrSize
21	}
22	b := src.Bounds()
23	w, h := b.Dx(), b.Dy()
24	if w <= 0 || h <= 0 || w > MaxPixels/h {
25		return 0, 0, ErrSize
26	}
27	return w, h, nil
28}
29
30// Decode accepts only PNG or JPEG bytes and checks dimensions before allocating pixels.
31// The caller bounds the input byte slice before reading it from an untrusted stream.
32func Decode(data []byte) (image.Image, error) {
33	config, format, err := image.DecodeConfig(bytes.NewReader(data))
34	if err != nil {
35		return nil, err
36	}
37	if format != "png" && format != "jpeg" {
38		return nil, errors.New("image: unsupported format")
39	}
40	if config.Width <= 0 || config.Height <= 0 || config.Width > MaxPixels/config.Height {
41		return nil, ErrSize
42	}
43	img, _, err := image.Decode(bytes.NewReader(data))
44	if err != nil {
45		return nil, err
46	}
47	if _, _, err = Size(img); err != nil {
48		return nil, err
49	}
50	return img, nil
51}