Function decode_image_bounded 

pub fn decode_image_bounded(bytes: &[u8]) -> Result<DynamicImage, String>

Decode an image with allocation limits. A tiny file declaring 60000×60000 would otherwise allocate ~14 GB before a single pixel decodes — every decode of bytes we didn’t author must go through this.