Release/1.2.5 (#761)

Signed-off-by: Adam Vollrath <[email protected]>
Co-authored-by: shuai <[email protected]>
Co-authored-by: kelvinkuo <[email protected]>
Co-authored-by: hgaol <[email protected]>
Co-authored-by: sy-records <[email protected]>
Co-authored-by: Adam Vollrath <[email protected]>
Co-authored-by: kumfo <[email protected]>
Co-authored-by: Yang Wong <yang wang>
Co-authored-by: hbsciw <[email protected]>

pkg/checker/file_type.go

@@ -29,21 +29,53 @@ import (
 	"strings"
 )
 
+const (
+	maxImageSize = 8192 * 8192
+)
+
 // IsSupportedImageFile currently answers support image type is
 // `image/jpeg, image/jpg, image/png, image/gif, image/webp`
 func IsSupportedImageFile(file io.Reader, ext string) bool {
 	ext = strings.ToLower(strings.TrimPrefix(ext, "."))
 	var err error
 	switch ext {
 	case "jpg", "jpeg", "png", "gif": // only allow for `image/jpeg,image/jpg,image/png, image/gif`
+		if !checkImageSize(file) {
+			return false
+		}
 		_, _, err = image.Decode(file)
 	case "ico":
 		// TODO: There is currently no good Golang library to parse whether the image is in ico format.
 		return true
 	case "webp":
+		if !checkWebpSize(file) {
+			return false
+		}
 		_, err = webp.Decode(file)
 	default:
 		return false
 	}
 	return err == nil
 }
+
+func checkImageSize(file io.Reader) bool {
+	config, _, err := image.DecodeConfig(file)
+	if err != nil {
+		return false
+	}
+	if (config.Width * config.Height) > maxImageSize {
+		return false
+	}
+	return true
+}
+
+func checkWebpSize(file io.Reader) bool {
+	config, err := webp.DecodeConfig(file)
+	if err != nil {
+		return false
+	}
+	if (config.Width * config.Height) > maxImageSize {
+		return false
+	}
+	return true
+}