read_header had no reader for GIF or BMP and fell back to a full decode, so a few-dozen-byte file
declaring a canvas just under the 1-gigapixel limit made the import probe allocate ~4.3 GB; a
failed allocation aborts the process. A decode had the same allocation.
- other::header reads the size from the header. A canvas up to 4 MP is still decoded there, so
truncated small files are refused at import as before.
- check_fillable refuses a canvas larger than the file's bytes can describe (BMP: 128 pixels per
byte, covering 1-bit and RLE; GIF: 11,000, an LZW code of at least 3 bits expanding to at most
4096 pixels), in both the probe and the decode, before the decoder allocates.
- The GIF and BMP decoders get an allocation limit (the RGBA buffer of max_pixels).
The approach follows the abandoned #2182 (PierrunoYT). JPEG XL still decodes in the probe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K93HTyCiwYvbRGaAkjPvXn
Claude
c2cdb112b7