From 604e06eaa82bb04f33f19961ed871525dd5419b9 Mon Sep 17 00:00:00 2001
From: Michael Droettboom <mdboom@gmail.com>
Date: Wed, 29 Jun 2016 09:46:00 -0400
Subject: [PATCH] Guard against too-large figures

---
 lib/matplotlib/tests/test_agg.py | 9 +++++++++
 src/_backend_agg_wrapper.cpp     | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/lib/matplotlib/tests/test_agg.py b/lib/matplotlib/tests/test_agg.py
index 748a6287477..e392e97a9a1 100644
--- a/lib/matplotlib/tests/test_agg.py
+++ b/lib/matplotlib/tests/test_agg.py
@@ -11,6 +11,8 @@
 import numpy as np
 from numpy.testing import assert_array_almost_equal
 
+from nose.tools import assert_raises
+
 from matplotlib.image import imread
 from matplotlib.backends.backend_agg import FigureCanvasAgg as FigureCanvas
 from matplotlib.figure import Figure
@@ -290,6 +292,13 @@ def process_image(self, padded_src, dpi):
     ax.yaxis.set_visible(False)
 
 
+@cleanup
+def test_too_large_image():
+    fig = plt.figure(figsize=(300, 1000))
+    buff = io.BytesIO()
+    assert_raises(ValueError, fig.savefig, buff)
+
+
 if __name__ == "__main__":
     import nose
     nose.runmodule(argv=['-s', '--with-doctest'], exit=False)
diff --git a/src/_backend_agg_wrapper.cpp b/src/_backend_agg_wrapper.cpp
index 494f7316f4b..1b6bdc4cb46 100644
--- a/src/_backend_agg_wrapper.cpp
+++ b/src/_backend_agg_wrapper.cpp
@@ -177,6 +177,15 @@ static int PyRendererAgg_init(PyRendererAgg *self, PyObject *args, PyObject *kwd
         return -1;
     }
 
+    if (width >= 1 << 16 || height >= 1 << 16) {
+        PyErr_Format(
+            PyExc_ValueError,
+            "Image size of %dx%d pixels is too large. "
+            "It must be less than 2^16 in each direction.",
+            width, height);
+        return -1;
+    }
+
     CALL_CPP_INIT("RendererAgg", self->x = new RendererAgg(width, height, dpi))
 
     return 0;