Increase decoded image limit to 48 megapixels

[TorstenDittmann]

Summary

• increase the decoded image limit from 20 to 48 megapixels
• allow the reported 6,000 by 4,000 image with margin for larger images
• verify successful decoding above the previous limit
• update the rejection boundary and documentation

Testing

Not run per request.

[appwrite]

Autogravity

Project ID: 6a9e5d640016fa6fb653

Sites (1)

Site	Status	Logs	Preview	QR
Docs autogravity-docs	Ready	View Logs	Preview URL

Tip

Each function runs in its own isolated container with custom environment variables

[greptile-apps]

Confidence Score: 4/5

The PR is not yet safe to merge because concurrent near-limit decodes can still create substantial aggregate memory pressure, and the new acceptance test violates an explicit repository testing requirement.

Findings

1.   Decoded images exhaust memory ▶
2.  Test Mirrors Implementation Limit ▶

Fix with agent prompt

### Issue 1
internal/imageutil/image.go:undefined-18
Raising this limit to 100 megapixels lets an attacker-controlled compressed image allocate roughly 400 MB for one decoded RGBA buffer, and auto-orientation can require more. Decoding is limited only by the number of concurrent analyses, which defaults to `GOMAXPROCS`, rather than by aggregate decoded memory. Several concurrent requests can therefore consume multiple gigabytes and terminate a memory-constrained service. Add memory-aware admission control or otherwise ensure concurrent decodes remain within the process memory budget.

**How this was verified:** Uploaded bytes reach full image decoding after only a pixel-count check, while concurrent decodes are governed by request count rather than aggregate decoded size.

### Issue 2
internal/imageutil/image_test.go:162-175
This test hard-codes a 7,500×6,000 image whose 45-million-pixel size was selected to sit just below the 48-million-pixel limit in `image.go`. Changing that configuration will therefore require rewriting the test even when the intended user-facing behavior is unchanged. This violates the repository directive not to mirror source configuration in assertions and to test observable behavior instead. Use the reported 6,000×4,000 image as the behavioral case. This repository requirement must be satisfied before merging.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This revision reduces the proposed decoded-image ceiling from 100 to 48 megapixels, aligns the public documentation with that limit, replaces the invalid boundary test with a successful full-image decode, and moves the rejection case immediately above the new ceiling.

• Raises the decoded-image limit from 20 to 48 megapixels.
• Documents the new limit in both documentation surfaces.
• Adds a valid successful decode above the former limit and updates the oversized-image rejection case.

_{Reviews (2) · Last reviewed commit: "Increase decoded image limit to 48 megap..."}