1 files changed, 5 insertions, 1 deletions
diff --git a/MediaBrowser.Controller/Drawing/ImageHelper.cs b/MediaBrowser.Controller/Drawing/ImageHelper.cs
index 9ef92bc981..c1d0203897 100644
--- a/MediaBrowser.Controller/Drawing/ImageHelper.cs
+++ b/MediaBrowser.Controller/Drawing/ImageHelper.cs
@@ -11,7 +11,11 @@ namespace MediaBrowser.Controller.Drawing
             // Determine the output size based on incoming parameters
             var newSize = DrawingUtils.Resize(originalImageSize, options.Width ?? 0, options.Height ?? 0, options.MaxWidth ?? 0, options.MaxHeight ?? 0);
             newSize = DrawingUtils.ResizeFill(newSize, options.FillWidth, options.FillHeight);
-            return newSize;
+
+            // Never encode larger than the source. Upscaling adds no detail, and the requested
+            // width/height are caller-controlled, so without this an unauthenticated request can
+            // pin a CPU and allocate several GB encoding a single image.
+            return DrawingUtils.ScaleDownToFit(newSize, originalImageSize);
         }
     }
 }