mirror of
https://github.com/storytold/vectorcraft.git
synced 2026-10-25 02:07:09 -06:00
dotCooCoo
db2bbcf405
Before the Eyedropper samples an image, or Edit Colors, Recolor Artwork or a color adjustment effect recolors an embedded one, `rgba_within` reads the image's size from its header and checks its size as RGBA against the allowance. The check multiplied width × height × 4 in 64 bits. A TIFF's sides go up to 2^32 - 1 pixels, so a header of 2^31 × 2^31 pixels overflowed that product: debug and test builds panicked with "attempt to multiply with overflow", and release builds wrapped it to 0 before the decoder's own 512 MB limit refused the image. The check now compares width × height with the allowance divided by 4. Every size whose RGBA bytes fit in 64 bits gets the same answer as before, and a larger one is refused.