security: preflight PCX and XPM output allocations

crates/codecs/src/codecs/pcx.rs

@@ -72,8 +72,19 @@ pub(crate) fn decode(b: &[u8], limits: &Limits) -> Result<Image, CodecError> {
         return Err(bad("8-bit indexed PCX has no 256-colour palette"));
     }
     let image_end = if vga { b.len() - 769 } else { b.len() };
+    // Each RLE packet emits at most 63 bytes and occupies at least two bytes.
+    // Reject inputs that cannot possibly contain all scanlines before allocating
+    // the decoded image buffer.
+    let min_packets = stride.div_ceil(63).checked_mul(2).ok_or_else(|| bad("compressed row size overflow"))?;
+    let min_encoded = min_packets.checked_mul(h as usize).and_then(|n| n.checked_mul(planes)).ok_or_else(|| bad("compressed image size overflow"))?;
+    let encoded_len = image_end.saturating_sub(HEADER);
+    if encoded_len < min_encoded {
+        return Err(bad("PCX pixel data is too short for the declared image"));
+    }
     let mut row = vec![0u8; row_len];
-    let mut pixels = vec![0u8; total];
+    let mut pixels = Vec::new();
+    pixels.try_reserve_exact(total).map_err(|_| bad("PCX pixel buffer is too large"))?;
+    pixels.resize(total, 0);
     let mut p = HEADER;
     let width = w as usize;
     for y in 0..h as usize {

crates/codecs/src/codecs/xpm.rs

@@ -206,11 +206,16 @@ fn decode_lines(lines: &[Vec<u8>], limits: &Limits) -> Result<Image, CodecError>
         }
     }
     let row_len = width.checked_mul(cpp).ok_or_else(|| bad("row byte count overflow"))?;
-    let mut pixels = vec![0u8; width.checked_mul(height).and_then(|n| n.checked_mul(4)).ok_or_else(|| bad("pixel size overflow"))?];
+    // Validate all source rows before reserving the decoded RGBA image. A malformed
+    // short row must not be able to make a large header-sized allocation first.
+    if lines[1 + colours..required].iter().any(|line| line.len() != row_len) {
+        return Err(bad("XPM row has the wrong width"));
+    }
+    let total = width.checked_mul(height).and_then(|n| n.checked_mul(4)).ok_or_else(|| bad("pixel size overflow"))?;
+    let mut pixels = Vec::new();
+    pixels.try_reserve_exact(total).map_err(|_| bad("XPM pixel buffer is too large"))?;
+    pixels.resize(total, 0);
     for (y, line) in lines[1 + colours..required].iter().enumerate() {
-        if line.len() != row_len {
-            return Err(bad("XPM row has the wrong width"));
-        }
         for x in 0..width {
             let key = &line[x * cpp..(x + 1) * cpp];
             let rgba = palette.get(key).ok_or_else(|| bad("unknown palette key"))?;