Bound decoded GIF frame storage

Summary:
GIF logical-screen dimensions are expanded into full-canvas RGBA32 frames. A tiny input declaring a 24,930 by 38,911 screen therefore drives roughly 3.9 GiB of initialization before any useful decode result.

Reject a single canvas or retained frame set above the existing 1 GiB decoded-frame budget, before allocating or copying it. The division-based checks add O(1) work; accepted decode complexity remains O(frame count * canvas pixels), with aggregate output storage bounded to 1 GiB. Add a synthetic regression with the exact oversized dimensions and a valid 1x1 control.

Differential Revision: D114062863

fbshipit-source-id: faf9ebdeb9a0c6ec39694047eebda071adbb1224

Author: Baojun Wang

impl/ocean/media/openimagelibraries/ImageGif.cpp

@@ -175,6 +175,23 @@ Frames ImageGif::decodeImages(const void* buffer, const size_t size, const size_
 
 	const ScopedFunctionVoid scopedCloseFileFunction(std::bind(&DGifCloseFile, gifFile, &error));
 
+	const int maxWidth = gifFile->SWidth;
+	const int maxHeight = gifFile->SHeight;
+
+	// Each output image is retained as a full-canvas RGBA32 frame. Bound the
+	// aggregate resident frame storage before allocating or copying it.
+	constexpr uint64_t maximalDecodedBytes = 1024ull * 1024ull * 1024ull;
+	constexpr uint64_t bytesPerPixel = 4ull;
+	constexpr uint64_t maximalDecodedPixels = maximalDecodedBytes / bytesPerPixel;
+
+	const bool hasValidDimensions = maxWidth >= 1 && maxHeight >= 1;
+	const uint64_t framePixels = hasValidDimensions ? uint64_t(maxWidth) * uint64_t(maxHeight) : 0ull;
+
+	if (framePixels > maximalDecodedPixels)
+	{
+		return Frames();
+	}
+
 	if (DGifSlurp(gifFile) != GIF_OK)
 	{
 		return Frames();
@@ -192,18 +209,15 @@ Frames ImageGif::decodeImages(const void* buffer, const size_t size, const size_
 		numberImages = std::min(numberImages, maximalImages);
 	}
 
-	Frames frames;
+	if (framePixels > maximalDecodedPixels / uint64_t(numberImages))
+	{
+		return Frames();
+	}
 
-	const int maxWidth = gifFile->SWidth;
-	const int maxHeight = gifFile->SHeight;
+	Frames frames;
 
-	if (maxWidth >= 1 && maxHeight >= 1)
+	if (hasValidDimensions)
 	{
-		if (uint64_t(maxWidth) * uint64_t(maxHeight) >= uint64_t(1073741823ull)) // width * height * 4 < 2^32
-		{
-			return Frames();
-		}
-
 		const FrameType::PixelFormat pixelFormat = FrameType::FORMAT_RGBA32;
 
 		const FrameType frameType = FrameType((unsigned int)(maxWidth), (unsigned int)(maxHeight), pixelFormat, FrameType::ORIGIN_UPPER_LEFT);

impl/ocean/test/testmedia/TestOpenImageLibraries.cpp

@@ -482,6 +482,25 @@ TEST_F(TestOpenImageLibrariesGTestInstance, TifImageRGBA32Recorder)
 
 #ifdef OCEAN_MEDIA_OIL_SUPPORT_GIF
 
+TEST_F(TestOpenImageLibrariesGTestInstance, DecodeImages_OversizedLogicalScreen_ReturnsEmpty)
+{
+	std::vector<uint8_t> gif = {
+		0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0x01, 0x00, 0x01, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0xFF, 0xFF, 0xFF, 0x21, 0xF9, 0x04, 0x01, 0x00, 0x00, 0x00, 0x00, 0x2C, 0x00, 0x00, 0x00, 0x00,
+		0x01, 0x00, 0x01, 0x00, 0x00, 0x02, 0x02, 0x44, 0x01, 0x00, 0x3B};
+
+	EXPECT_EQ(Media::OpenImageLibraries::ImageGif::decodeImages(gif.data(), gif.size()).size(), 1u);
+
+	constexpr uint16_t oversizedWidth = 24930u;
+	constexpr uint16_t oversizedHeight = 38911u;
+	gif[6] = uint8_t(oversizedWidth);
+	gif[7] = uint8_t(oversizedWidth >> 8u);
+	gif[8] = uint8_t(oversizedHeight);
+	gif[9] = uint8_t(oversizedHeight >> 8u);
+
+	EXPECT_TRUE(Media::OpenImageLibraries::ImageGif::decodeImages(gif.data(), gif.size()).empty());
+}
+
 #ifndef OCEAN_DEBUG
 	TEST_F(TestOpenImageLibrariesGTestInstance, GifDecodeStressTest)
 	{