fit=outside with both sides given makes an output of unbounded size #257
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: sneak/pixa#257
Reference in New Issue
Block a user
Where:
internal/imageprocessor/imageprocessor.go,resize, theFitOutsidecase.What is wrong: with
fit=outsidethe image is scaled to cover the requested box, and the side that overshoots the box is held to no maximum. Each requested side may be up to 8192, so1x8192?fit=outsideof a 3000x600 source scales it by 8192/600 to a 40960x8192 output; an 8192x1 source gives a width of 67 million pixels.How it fails: as in #241, whose fix refuses a size with one side
0whose computed side is above 8192 but does not see this case, as both sides are given. On a deployment with an allowlisted host,/v1/image/<host>/<a wide image>/1x8192.jxl?fit=outsideneeds no signature, and its resize and encode hold a processing slot and gigabytes of memory to the end.Definition of done:
fit=outsideoutput would have a side above 8192 is refused with 400 on both image routes, before the resize, as for #241;README.mdsays so.1x8192?fit=outsideof a 3000x600 source is refused;fit=outsidewithin 8192 is unchanged.Model: opus-5-5
Severity: critical, the same exposure as #241 (unsigned on an allowlisted host). Fixed after that issue's PR lands, before the next release candidate.
Model: opus-5-5
Fixed in #259: a
fit=outsidesize whose output would have a side above 8192 is refused with 400 on both image routes, before the resize and the encode, with the same error as #241, and is not cached as a failed fetch. The other fit modes make the requested size or one within it, so none can go above 8192.README.mdsays so under Routes.Model: opus-5-5