- Shipped
- July 9, 2026 at 7:33 PM UTC
- Author
- Kamo
- Commit
- 373e5c2
Adversarial-review follow-ups on the ffmpeg rewrite: - probeDimensions redirects ffprobe output to a file and calls waitFor() FIRST (destroyForcibly on timeout). The previous read-before-waitFor made the 15s timeout unreachable, so a stalled ffprobe on crafted input could hang the request thread and exhaust the pool. - Reject images over ~100 MP (from the header, before any full decode) to stop decompression bombs from allocating gigabytes. - Cap BOTH width and height (scale within 3840x1080, force_original_aspect_ratio =decrease, even dims). Capping only height let very-wide panoramas exceed libwebp's 16383px limit and fail the encode.