mirror of
https://github.com/storytold/effectcraft.git
synced 2026-10-28 20:16:52 -06:00
midasmatterhorn
5e18a7fd92
inline_len computed (w * n * bpc).div_ceil(8) * h with Width/Height taken straight from the content stream and no size validation — unlike decode() and mask_image, which bound their geometry first. /W 5000000000000000000 overflows the multiply in debug and test builds; in release it wraps to a small length and the caller slices the wrong bytes, misparsing the image and shifting the EI resync. Chain the arithmetic through checked_mul and return None, which the caller already routes to the EI-scan fallback. Regression test: inline_image_with_absurd_dimensions_falls_back_to_ei_scan — panics at crates/pdf/src/image.rs:85 on main, passes with the chain.