image size limit?

[Chong Yidong <cyd@stupidchicken.com>]

Can we get this discussion going again?  From FOR-RELEASE:

  Put a max-limit on the size of images, e.g. based on the display
  size.  This is to avoid allocating insane amounts of memory due to
  bogus image size specifications.  Note: rather than clipping images
  that are too big (this may be non-trivial to do correctly in all
  cases -- and thus non-trivial to test), it may be better just to
  avoid displaying such images for emacs 22.

I am not an expert, but from looking through image.c, it seems that
there is only so much we can do to prevent memory over-allocation
problems.  Generally, we have to call an external library to load an
image file, which does its own memory management thing.  By the time
we know the width and height, the external library has already loaded
the file into memory (or signalled an error).

For example, gif_load looks something like this:

  gif = (GifFileType *)fn_DGifOpenFileName (SDATA (file));
  ....
  /* Read entire contents.  */
  rc = fn_DGifSlurp (gif);
  ...
  image_top = gif->SavedImages[ino].ImageDesc.Top;
  ...
  x_create_x_image_and_pixmap (f, width, height, ...);

We have no control over what DGifSlurp does.

One place where we can set a limit is in x_create_x_image_and_pixmap,
where we malloc a pixmap to store the image contents.  The data
supplied to us by the external library is copied into this pixmap.  We
could signal an error if width and height are too large.  However,
this seems like closing the barn door after the horses have left --
the external library will already have allocated a big chunk of
memory.

Thoughts?