From 6edfe44d53f95fd660349b954dc3b61aa13015c8 Mon Sep 17 00:00:00 2001
From: Zach Bjornson <bjornson@stanford.edu>
Date: Sat, 19 Mar 2016 13:06:59 -0700
Subject: [PATCH] Clamp JPEG buffer size. Fixes #674

---
 lib/canvas.js       |  5 ++++-
 test/canvas.test.js | 10 ++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/lib/canvas.js b/lib/canvas.js
index afb872e..20aeb26 100644
--- a/lib/canvas.js
+++ b/lib/canvas.js
@@ -185,8 +185,11 @@ Canvas.prototype.createJPEGStream = function(options){
 Canvas.prototype.syncJPEGStream =
 Canvas.prototype.createSyncJPEGStream = function(options){
   options = options || {};
+  // Don't allow the buffer size to exceed the size of the canvas (#674)
+  var maxBufSize = this.width * this.height * 4;
+  var clampedBufSize = Math.min(options.bufsize || 4096, maxBufSize);
   return new JPEGStream(this, {
-      bufsize: options.bufsize || 4096
+      bufsize: clampedBufSize
     , quality: options.quality || 75
     , progressive: options.progressive || false
   });
diff --git a/test/canvas.test.js b/test/canvas.test.js
index ad62344..64ef4c7 100644
--- a/test/canvas.test.js
+++ b/test/canvas.test.js
@@ -786,4 +786,14 @@ describe('Canvas', function () {
       done(err);
     });
   });
+
+  it('Canvas#jpegStream() should clamp buffer size (#674)', function (done) {
+    var c = new Canvas(10, 10);
+    var SIZE = 10 * 1024 * 1024;
+    var s = c.jpegStream({bufsize: SIZE});
+    s.on('data', function (chunk) {
+      assert(chunk.length < SIZE);
+    });
+    s.on('end', done);
+  })
 });