add size checks

lib/load_bmp.rb

@@ -3,6 +3,9 @@
 module LoadBmp
   BPPS = [1, 4, 8, 24, 32].freeze
 
+  MAX_COORD = ENV.fetch('VIPS_MAX_COORD', '17000').to_i
+  MAX_PIXELS = 145_000_000
+
   module_function
 
   # rubocop:disable Metrics
@@ -98,6 +101,9 @@ module LoadBmp
 
     raise ArgumentError, 'BMP width must be positive.' if width <= 0
     raise ArgumentError, 'BMP height must be positive.' if height <= 0
+    if width > MAX_COORD || height > MAX_COORD || width * height > MAX_PIXELS
+      raise ArgumentError, "BMP dimensions are too large: #{width}x#{height}."
+    end
 
     if compression != 0
       raise ArgumentError,

lib/load_ico.rb

@@ -94,7 +94,7 @@ module LoadIco
 
     palette = []
     if dib_bpp <= 8
-      num_palette_entries = dib_clr_used.zero? ? (1 << dib_bpp) : dib_clr_used
+      num_palette_entries = [dib_clr_used.zero? ? (1 << dib_bpp) : dib_clr_used, 1 << dib_bpp].min
       num_palette_entries.times do
         palette_color_bytes = dib_io.read(4)
         return nil unless palette_color_bytes && palette_color_bytes.bytesize == 4

lib/verify_pdf_signature.rb

@@ -144,7 +144,7 @@ module VerifyPdfSignature
 
     io.seek(0)
 
-    Pdfium::Document.open_bytes(io.read(signed_end)) do |signed_document|
+    Pdfium::Document.open_bytes(io.read([[signed_end, io.size].min, 0].max)) do |signed_document|
       next false unless signed_document.valid_cross_reference_table?
 
       serialized_document(signed_document) != serialized_document(document)
@@ -164,7 +164,7 @@ module VerifyPdfSignature
   def signed_data(io, byte_range)
     byte_range.each_slice(2).map do |offset, length|
       io.seek(offset)
-      io.read(length)
+      io.read([[length, io.size - offset].min, 0].max)
     end.join
   end
 end