🔒 Fix Integer Overflow and DoS in ImageData.Read

src/GameUtils/Types/ImageData.cs

@@ -158,7 +158,18 @@ public static ImageData Read(Stream source)
 
         var width = reader.ReadInt32();
         var height = reader.ReadInt32();
-        var data = new Vector4[width * height];
+        if (width <= 0 || height <= 0)
+        {
+            throw new InvalidDataException("Width and height must be positive");
+        }
+
+        long totalPixels = (long)width * height;
+        if (totalPixels > 67_108_864) // 1 GB max memory allocation (16 bytes per Vector4)
+        {
+            throw new InvalidDataException("Image size exceeds maximum allowed limit of 1GB");
+        }
+
+        var data = new Vector4[(int)totalPixels];
         for (var i = 0; i < data.Length; i++)
         {
             data[i] = new Vector4(

tests/GameUtils.Tests/Types/ImageDataTests.cs

@@ -8,6 +8,40 @@ namespace GameUtils.Tests.Types
     [TestClass]
     public class ImageDataTests
     {
+        [TestMethod]
+        public void Read_WithNegativeDimensions_ThrowsInvalidDataException()
+        {
+            using var ms = new MemoryStream();
+            using (var compressor = new System.IO.Compression.GZipStream(ms, System.IO.Compression.CompressionLevel.Optimal, true))
+            using (var writer = new BinaryWriter(compressor))
+            {
+                writer.Write("IMGD"u8);
+                writer.Write(-1);
+                writer.Write(10);
+            }
+
+            ms.Position = 0;
+
+            Assert.ThrowsExactly<InvalidDataException>(() => ImageData.Read(ms));
+        }
+
+        [TestMethod]
+        public void Read_WithExcessiveDimensions_ThrowsInvalidDataException()
+        {
+            using var ms = new MemoryStream();
+            using (var compressor = new System.IO.Compression.GZipStream(ms, System.IO.Compression.CompressionLevel.Optimal, true))
+            using (var writer = new BinaryWriter(compressor))
+            {
+                writer.Write("IMGD"u8);
+                writer.Write(20000);
+                writer.Write(20000); // 400M pixels > 67.1M limit
+            }
+
+            ms.Position = 0;
+
+            Assert.ThrowsExactly<InvalidDataException>(() => ImageData.Read(ms));
+        }
+
         [TestMethod]
         public void Write_WithTraversalPath_ThrowsUnauthorizedAccessException()
         {