V4 - Limit all memory allocations to configurable values.

src/ImageSharp/Formats/Bmp/BmpDecoderCore.cs

@@ -1390,6 +1390,16 @@ private int ReadImageHeaders(BufferedReadStream stream, out bool inverted, out b
         this.ReadFileHeader(stream);
         this.ReadInfoHeader(stream);
 
+        // BMPs with negative-or-zero width are invalid. Also, reject extremely wide images
+        // to keep the math sane. And reject int.MinValue as a height because you can't
+        // get its absolute value (because -int.MinValue is one more than int.MaxValue).
+        const int k64KWidth = 65535;
+        bool sizeOk = this.infoHeader.Width > 0 && this.infoHeader.Width <= k64KWidth && this.infoHeader.Height != int.MinValue;
+        if (!sizeOk)
+        {
+            BmpThrowHelper.ThrowInvalidImageContentException($"Invalid file header dimensions found. {this.infoHeader.Width}x{this.infoHeader.Height}px.");
+        }
+
         // see http://www.drdobbs.com/architecture-and-design/the-bmp-file-format-part-1/184409517
         // If the height is negative, then this is a Windows bitmap whose origin
         // is the upper-left corner and not the lower-left. The inverted flag

tests/ImageSharp.Tests/Formats/Bmp/BmpDecoderTests.cs

@@ -558,4 +558,13 @@ public void BmpDecoder_CanDecode_Os2BitmapArray<TPixel>(TestImageProvider<TPixel
         // Compare to reference output instead.
         image.CompareToReferenceOutput(provider, extension: "png");
     }
+
+    [Theory]
+    [WithFile(Issue2696, PixelTypes.Rgba32)]
+    public void BmpDecoder_ThrowsException_Issue2696<TPixel>(TestImageProvider<TPixel> provider)
+    where TPixel : unmanaged, IPixel<TPixel>
+        => Assert.Throws<InvalidImageContentException>(() =>
+        {
+            using Image<TPixel> image = provider.GetImage(BmpDecoder.Instance);
+        });
 }

tests/ImageSharp.Tests/TestImages.cs

@@ -442,6 +442,8 @@ public static class Bmp
 
         public const string BlackWhitePalletDataMatrix = "Bmp/bit1datamatrix.bmp";
 
+        public const string Issue2696 = "Bmp/issue-2696.bmp";
+
         public static readonly string[] BitFields =
         {
               Rgb32bfdef,