lodepng icon indicating copy to clipboard operation
lodepng copied to clipboard

Set hard limit for image buffer size

Open hpjansson opened this issue 2 years ago • 0 comments

A security researcher found that it was possible to make lodepng allocate a terabyte or more of memory by supplying bogus image dimensions. This adds a compiled-in upper limit on the size of the allocation for uncompressed image data.

Maybe you want this to be configurable at runtime (possibly by generalizing zlibsettings->max_output_size). Any solution works for me as long as it's possible to specify a limit :-)

hpjansson avatar Jul 03 '22 22:07 hpjansson