Take the 2-minute tour ×

I could use getimagesize() to validate an image, but the problem is what if the mischievous user puts a link to a 10GB random file then it would whack my production server's bandwidth. How do I limit the filesize getimagesize() is getting? (eg. 5MB max image size)

PS: I did research before asking.

share|improve this question
Maybe this suits your use case stackoverflow.com/questions/4635936/… –  Mike Sep 3 '12 at 14:51
add comment

3 Answers

up vote 2 down vote accepted

You can download the file separately, imposing a maximum size you wish to download:

function mygetimagesize($url, $max_size = -1)
        // create temporary file to store data from $url
        if (false === ($tmpfname = tempnam(sys_get_temp_dir(), uniqid('mgis')))) {
                return false;
        // open input and output
        if (false === ($in = fopen($url, 'rb')) || false === ($out = fopen($tmpfname, 'wb'))) {
                return false;
        // copy at most $max_size bytes
        stream_copy_to_stream($in, $out, $max_size);

        // close input and output file
        fclose($in); fclose($out);

        // retrieve image information
        $info = getimagesize($tmpfname);

        // get rid of temporary file

        return $info;
share|improve this answer
Hi, wouldn't I have memory issues with stream_copy_to_stream if I have like 100 users uploading simultaneously? –  Pineapple Under the Sea Sep 3 '12 at 15:41
@Severus how would you imagine that? Internally it uses 8K buffers to perform the copy I believe. –  Jack Sep 3 '12 at 15:45
@Severus could you be more specific? :) –  Jack Sep 4 '12 at 11:33
so how will I throw an exception when the limit is reached? –  Pineapple Under the Sea Sep 4 '12 at 11:38
@Severus stream_copy_to_stream() returns the bytes copied so you could check if the number equals $max_size –  Jack Sep 4 '12 at 11:49
show 5 more comments

You don't want to do something like getimagesize('http://example.com') to begin with, since this will download the image once, check the size, then discard the downloaded image data. That's a real waste of bandwidth.

So, separate the download process from the checking of the image size. For example, use fopen to open the image URL, read little by little and write it to a temporary file, keeping count of how much you have read. Once you cross 5MB and are still not finished reading, you stop and reject the image.

You could try to read the HTTP Content-Size header before starting the actual download to weed out obviously large files, but you cannot rely on it, since it can be spoofed or omitted.

share|improve this answer
add comment

Here is an example, you need to make some change to fit your requirement.

function getimagesize_limit($url, $limit)
 global $phpbb_root_path;
 $tmpfilename = tempnam($phpbb_root_path . 'store/', unique_id() . '-');
 if (!$fp) return false; 
 $tmpfile = fopen($tmpfilename, 'w');
  $size = 0;
 while (!feof($fp) && $size<$limit)
  $content = fread($fp, 8192);
  $size += 8192;  fwrite($tmpfile, $content);
  $is = getimagesize($tmpfilename);
 return $is;
share|improve this answer
Can I ask why you add 8192? –  Pineapple Under the Sea Sep 3 '12 at 14:58
@Severus It's just mean read 8kb one time, no special meanings. –  xdazz Sep 3 '12 at 14:59
which file at phpbb is this implemented? –  Pineapple Under the Sea Sep 3 '12 at 15:16
add comment

Your Answer


