Module image_limits 

Bounds on file-declared image dimensions.

/Width, /Height, and /BitsPerComponent are arbitrary integers taken from the input, and every buffer size and loop bound downstream is derived from them. Two things go wrong without a ceiling: the products overflow — silently in release, where a wrapped size yields a buffer smaller than the loops that fill it — and even where the arithmetic survives, a declared size far larger than the data behind it is a denial of service. A 60-byte PostScript file requesting a 2000000000 x 2000000000 image asks for a 4 x 10^18 byte allocation, which aborts the process rather than failing.

These live in stet-graphics because both input paths need them and neither can see the other: the PostScript operators are in stet-ops, the PDF image handler is in stet-pdf-reader, and stet-pdf-reader deliberately does not depend on the interpreter. Duplicating the constants would let two prepress-calibrated numbers drift apart.

Calibration

Sized for prepress, not for the sample corpus. The corpus maximum is 151M pixels, but that is a sample of ordinary documents and is the wrong yardstick for a RIP. The sizes that matter:

Case	Pixels
40x28 inch press sheet @ 600 dpi	403M
A0 poster (33x47 in) @ 600 dpi	558M
60x40 inch grand format @ 600 dpi	864M
60x40 inch grand format @ 1200 dpi	3.46G

An earlier 400M ceiling, calibrated from the corpus, rejected all four.

Constants

MAX_BITS_PER_COMPONENT

Largest accepted bits-per-component.

MAX_IMAGE_DIMENSION

Largest accepted value for an image’s width or height, in samples.

MAX_IMAGE_PIXELS

Largest accepted pixel count (width * height) for a single image.

Functions

validate_bits_per_component

Validate a file-supplied bits-per-component, falling back to 8 when absent.

validate_image_dimension

Validate one file-supplied image dimension.

validate_image_size

Validate a width/height pair and return the pixel count.