fix(render): validate dimensions in PNG header estimate

This commit is contained in:
Dylan M. Taylor
2026-11-15 00:37:40 +00:00
parent 118a9b627f
commit fb45e7ecb5
+5 -1
View File
@@ -317,7 +317,11 @@ fn png_row_scratch_from_header(bytes: &[u8], width: u32, height: u32, total_byte
match kind {
b"IHDR" if len == 13 && !header => {
header = true;
if u32::from_be_bytes(data[..4].try_into().ok()?) != width || data[12] != 0 {
if at != 8
|| u32::from_be_bytes(data[..4].try_into().ok()?) != width
|| u32::from_be_bytes(data[4..8].try_into().ok()?) != height
|| data[12] != 0
{
return None;
}
}