From 1f31d7afaee1a32d41cd3fad0649ef482021240c Mon Sep 17 00:00:00 2001
From: Arne <1169654+arnef@users.noreply.github.com>
Date: Sat, 8 Aug 2026 13:40:38 +0200
Subject: [PATCH] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 internal/library/library.go | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/internal/library/library.go b/internal/library/library.go
index 765a3db..323c10e 100644
--- a/internal/library/library.go
+++ b/internal/library/library.go
@@ -198,15 +198,22 @@ func readEPUBCover(filePath string) ([]byte, string, error) {
 		if path.Clean(f.Name) != coverPath {
 			continue
 		}
+		const maxCoverBytes = 10 << 20 // 10 MiB
+		if f.UncompressedSize64 > uint64(maxCoverBytes) {
+			return nil, "", fmt.Errorf("cover image too large")
+		}
 		rc, err := f.Open()
 		if err != nil {
 			return nil, "", err
 		}
 		defer rc.Close()
-		data, err := io.ReadAll(rc)
+		data, err := io.ReadAll(io.LimitReader(rc, int64(maxCoverBytes)+1))
 		if err != nil {
 			return nil, "", err
 		}
+		if len(data) > maxCoverBytes {
+			return nil, "", fmt.Errorf("cover image too large")
+		}
 		return data, detectContentType(data, f.Name), nil
 	}