ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)
The readPsd() function in ag-psd accepts a totalMemoryLimit option to cap memory usage when parsing untrusted PSD files, but this limit is never forwarded to the layer image buffer allocation path. A property name mismatch (totalMemoryLimit vs. memoryLimit) causes the size guard inside createImageDataBitDepth to be skipped unconditionally. An attacker who can supply a crafted PSD to any application using ag-psd for server-side parsing can force an unbounded heap allocation …