Stop image endpoints from upscaling beyond the source resolution

ImageHelper.GetNewImageSize passed the caller-supplied width/height straight
through to SkiaEncoder.EncodeImage, which allocates an SKImageInfo of exactly
that size. Nothing bounded those values against the source image, so a request
like Items/<id>/Images/Primary?width=23100&height=23100 made the server allocate
and resample a 23100x23100 surface from, say, a 600x336 poster: the reporter
measured 100% of a core for 10-15 minutes and 6-12 GB resident per request.
The item images endpoints do not require authentication, so any caller who knows
an item id can trigger this, and varying the size by one pixel misses the cache
every time.

Add DrawingUtils.ScaleDownToFit, which scales a size down uniformly until it
fits inside a bounding box and returns it unchanged if it already does, and
apply it in GetNewImageSize against the original image dimensions. Requests
that ask for more pixels than the source now get the source resolution back,
scaled to the requested aspect ratio. Downscaling paths are untouched, and
DrawingUtils.Resize keeps its existing behaviour for the transcoding callers in
EncodingJobInfo and StreamInfo, which legitimately size video output.
ResizeFill already refused to upscale; this makes width/height consistent
with fillWidth/fillHeight.

Fixes #17056.

1 files changed, 64 insertions, 0 deletions

diff --git a/tests/Jellyfin.Controller.Tests/Drawing/ImageHelperTests.cs b/tests/Jellyfin.Controller.Tests/Drawing/ImageHelperTests.cs
new file mode 100644
index 0000000000..571cb7f0d4
--- /dev/null
+++ b/tests/Jellyfin.Controller.Tests/Drawing/ImageHelperTests.cs
@@ -0,0 +1,64 @@
+using MediaBrowser.Controller.Drawing;
+using MediaBrowser.Model.Drawing;
+using Xunit;
+
+namespace Jellyfin.Controller.Tests.Drawing;
+
+public static class ImageHelperTests
+{
+    [Fact]
+    public static void GetNewImageSize_ExplicitSizeLargerThanSource_ClampsToSource()
+    {
+        // Regression test for https://github.com/jellyfin/jellyfin/issues/17056: the caller-supplied
+        // width/height were used verbatim, so a single request could ask for a 23100x23100 encode.
+        var options = new ImageProcessingOptions { Width = 23100, Height = 23100 };
+
+        var newSize = ImageHelper.GetNewImageSize(options, new ImageDimensions(600, 336));
+
+        Assert.Equal(336, newSize.Width);
+        Assert.Equal(336, newSize.Height);
+    }
+
+    [Fact]
+    public static void GetNewImageSize_WidthLargerThanSource_ClampsToSource()
+    {
+        var options = new ImageProcessingOptions { Width = 10000 };
+
+        var newSize = ImageHelper.GetNewImageSize(options, new ImageDimensions(600, 336));
+
+        Assert.Equal(600, newSize.Width);
+        Assert.Equal(336, newSize.Height);
+    }
+
+    [Fact]
+    public static void GetNewImageSize_FillLargerThanSource_ClampsToSource()
+    {
+        // ResizeFill already refused to upscale; this pins that behaviour.
+        var options = new ImageProcessingOptions { FillWidth = 23100, FillHeight = 23100 };
+
+        var newSize = ImageHelper.GetNewImageSize(options, new ImageDimensions(600, 336));
+
+        Assert.Equal(600, newSize.Width);
+        Assert.Equal(336, newSize.Height);
+    }
+
+    [Fact]
+    public static void GetNewImageSize_SmallerThanSource_StillDownscales()
+    {
+        var options = new ImageProcessingOptions { MaxWidth = 300 };
+
+        var newSize = ImageHelper.GetNewImageSize(options, new ImageDimensions(600, 336));
+
+        Assert.Equal(300, newSize.Width);
+        Assert.Equal(168, newSize.Height);
+    }
+
+    [Fact]
+    public static void GetNewImageSize_NoSizeRequested_ReturnsSource()
+    {
+        var newSize = ImageHelper.GetNewImageSize(new ImageProcessingOptions(), new ImageDimensions(600, 336));
+
+        Assert.Equal(600, newSize.Width);
+        Assert.Equal(336, newSize.Height);
+    }
+}