Method Decode

internal/attachments/processor_purego.go:64–92

Decode peeks at the image header to enforce MaxPixels BEFORE allocating the full pixel buffer. image.DecodeConfig reads only the header bytes (a few hundred at most), so an attacker who uploads a "claimed 100k x 100k pixels" PNG can't OOM us — we reject before image.Decode allocates the row buffers.

(r io.Reader)

// can replay it for the actual Decode. This costs a single io.ReadAll
// — bounded by the upload-handler's MaxBytesReader (25 MiB by default).
func (p *pureGoProcessor) Decode(r io.Reader) (image.Image, string, error) {
	buf, err := io.ReadAll(r)
	if err != nil {
		return nil, "", fmt.Errorf("attachments: read image bytes: %w", err)
	}
	cfg, format, err := image.DecodeConfig(bytes.NewReader(buf))
	if err != nil {
		// image.Decode would also fail; bail with a clearer error
		// message that distinguishes "format unknown" from "format
		// known, decoding failed mid-way" (a corrupt-bytes case).
		return nil, "", fmt.Errorf("%w: %v", ErrUnsupportedFormat, err)
	}
	if !p.formatSupported(format) {
		return nil, format, fmt.Errorf("%w: %s", ErrUnsupportedFormat, format)
	}
	if cfg.Width <= 0 || cfg.Height <= 0 {
		return nil, format, fmt.Errorf("%w: zero dimension (%dx%d)",
			ErrUnsupportedFormat, cfg.Width, cfg.Height)
	}
	if int64(cfg.Width)*int64(cfg.Height) > int64(p.caps.MaxPixels) {
		return nil, format, fmt.Errorf("%w: %dx%d exceeds %d",
			ErrImageTooLarge, cfg.Width, cfg.Height, p.caps.MaxPixels)
	}
	img, _, err := image.Decode(bytes.NewReader(buf))
	if err != nil {
		return nil, format, fmt.Errorf("attachments: decode %s: %w", format, err)
	}
	return img, format, nil
}

// Resize fits the longer edge to maxLong, preserving aspect ratio. The
// imaging package picks the right scale factor for whichever edge is