fix(dds): reject corrupt bytes-per-pixel before it forces a huge allocation

src/dds.imageio/ddsinput.cpp

@@ -618,6 +618,18 @@ DDSInput::open(const std::string& name, ImageSpec& newspec)
             m_nchans++;
     }
 
+    // Sanity-check the native bytes-per-pixel for uncompressed formats. The
+    // largest real uncompressed DDS/DXGI pixel format is 128-bit (16 bytes per
+    // pixel); a larger value comes from a corrupt bpp or format field and would
+    // otherwise drive a wildly oversized allocation in internal_readimg(). This
+    // is not caught by the core resolution/imagesize limits, which only see the
+    // (small) output ImageSpec, not the native pixel size.
+    if (m_compression == Compression::None && (m_Bpp < 1 || m_Bpp > 16)) {
+        errorfmt("Invalid DDS bytes-per-pixel ({}). Possible corrupt input?",
+                 m_Bpp);
+        return false;
+    }
+
     // fix depth, pitch and mipmaps for later use, if needed
     if (!(m_dds.fmt.flags & DDS_PF_FOURCC && m_dds.flags & DDS_PITCH))
         m_dds.pitch = m_dds.width * m_Bpp;

testsuite/dds/ref/out.txt

@@ -266,7 +266,7 @@ src/crash-1634.dds   :   16 x    8, 1 channel, uint8 dds
     channel list: Y
     textureformat: "Plain Texture"
     oiio:BitsPerSample: 16
-oiiotool ERROR: read : "src/crash-1635.dds": Unsupported DDS bit depth: 1048576 (maybe it's a corrupted file?)
+oiiotool ERROR: read : "src/crash-1635.dds": Invalid DDS bytes-per-pixel (131072). Possible corrupt input?
 Full command line was:
 > oiiotool --info -v -a --hash src/crash-1635.dds
 Reading src/crash-3950.dds
@@ -275,3 +275,6 @@ src/crash-3950.dds   :   16 x    1, 4 channel, uint8 dds
     channel list: R, G, B, A
     compression: "DXT4"
     textureformat: "Plain Texture"
+oiiotool ERROR: read : "src/crash-bpp.dds": Invalid DDS bytes-per-pixel (322122548). Possible corrupt input?
+Full command line was:
+> oiiotool --info -v -a --hash src/crash-bpp.dds

testsuite/dds/run.py

@@ -62,3 +62,6 @@
 command += info_command ("src/crash-1634.dds", hash=True)
 command += info_command ("src/crash-1635.dds", hash=True)
 command += info_command ("src/crash-3950.dds", hash=True)
+# crash-bpp.dds has a corrupt bytes-per-pixel that used to drive a multi-GB
+# allocation (OOM) before the native bpp was sanity-checked.
+command += info_command ("src/crash-bpp.dds", hash=True)