Android: constrain oversized image decodes to display bounds to prevent runtime bitmap draw crashes

src/Core/AndroidNative/maui/src/main/java/com/microsoft/maui/PlatformInterop.java

@@ -46,6 +46,7 @@
 import com.bumptech.glide.RequestBuilder;
 import com.bumptech.glide.RequestManager;
 import com.bumptech.glide.load.engine.DiskCacheStrategy;
+import com.bumptech.glide.load.resource.bitmap.DownsampleStrategy;
 import com.bumptech.glide.request.target.Target;
 
 import com.google.android.material.appbar.AppBarLayout;
@@ -336,10 +337,109 @@ private static void load(RequestBuilder<Drawable> builder, Context context, bool
         prepare(builder, target, cachingEnabled, callback);
     }
 
+    private static RequestBuilder<Drawable> limitToDisplaySize(RequestBuilder<Drawable> builder, Context context) {
+        if (context == null) {
+            return builder;
+        }
+
+        DisplayMetrics metrics = context.getResources().getDisplayMetrics();
+        if (metrics == null) {
+            return builder;
+        }
+
+        int width = metrics.widthPixels;
+        int height = metrics.heightPixels;
+        if (width <= 0 || height <= 0) {
+            return builder;
+        }
+
+        return builder
+            .downsample(DownsampleStrategy.CENTER_INSIDE)
+            .override(width, height);
+    }
+
+    private static RequestBuilder<Drawable> limitToTargetSize(RequestBuilder<Drawable> builder, ImageView imageView) {
+        // Cap the decode so an oversized bitmap can never reach the canvas draw (the crash this fixes),
+        // choosing a downsample strategy that matches the view's ScaleType (see AspectExtensions.cs for
+        // the Aspect -> ScaleType mapping):
+        //   * CENTER_CROP (Aspect.AspectFill) and FIT_XY (Aspect.Fill) fill the view on every axis, so a
+        //     COVER decode (CENTER_OUTSIDE) would keep the long axis of an extreme-aspect source above the
+        //     display bounds (e.g. a 4*displayWidth x displayHeight source still "covers" a display-sized
+        //     view at ~4*displayWidth). Cover quality cannot take priority over the safety invariant for a
+        //     crash fix, so cap these at the display size too; the ImageView matrix still crops/scales the
+        //     bounded bitmap to fill the view.
+        //   * CENTER (Aspect.Center) draws the source 1:1 without scaling, so decoding it down to the view
+        //     size would visibly change the result for any image larger than its view. Preserve native
+        //     resolution but still guard against oversized bitmaps by capping the decode at the display
+        //     size instead of the much smaller view size.
+        //   * FitCenter (Aspect.AspectFit) and the default only need to fit WITHIN the view, so honor the
+        //     view's own size when it declares one (keeps small/thumbnail loads cheap) but still fall back
+        //     to an explicit display ceiling when the view is WRAP_CONTENT / not yet measured, otherwise
+        //     Glide's target-size negotiation can still decode an extreme-aspect source above the display
+        //     bounds.
+        ImageView.ScaleType scaleType = imageView.getScaleType();
+        if (scaleType == ImageView.ScaleType.CENTER
+                || scaleType == ImageView.ScaleType.CENTER_CROP
+                || scaleType == ImageView.ScaleType.FIT_XY) {
+            return limitToDisplaySize(builder, imageView.getContext());
+        }
+
+        return limitToViewOrDisplaySize(builder, imageView);
+    }
+
+    private static RequestBuilder<Drawable> limitToViewOrDisplaySize(RequestBuilder<Drawable> builder, ImageView imageView) {
+        // FitCenter/AspectFit (MAUI's default Android scale type) only has to fit the source inside the
+        // view. A WRAP_CONTENT or not-yet-measured ImageView, however, gives Glide no bounded target, so an
+        // extreme-aspect source can still decode above the display bounds and crash. Prefer the view's own
+        // fixed/measured size when it has one (so small thumbnails stay cheap) and fall back to the display
+        // size as a hard ceiling otherwise.
+        builder = builder.downsample(DownsampleStrategy.CENTER_INSIDE);
+
+        Context context = imageView.getContext();
+        if (context == null) {
+            return builder;
+        }
+
+        DisplayMetrics metrics = context.getResources().getDisplayMetrics();
+        if (metrics == null) {
+            return builder;
+        }
+
+        int displayWidth = metrics.widthPixels;
+        int displayHeight = metrics.heightPixels;
+        if (displayWidth <= 0 || displayHeight <= 0) {
+            return builder;
+        }
+
+        int targetWidth = boundedDimension(imageView, true, displayWidth);
+        int targetHeight = boundedDimension(imageView, false, displayHeight);
+        return builder.override(targetWidth, targetHeight);
+    }
+
+    private static int boundedDimension(ImageView imageView, boolean horizontal, int displayLimit) {
+        // Honor an already-measured or fixed positive dimension (clamped to the display so it can never
+        // exceed it); WRAP_CONTENT / MATCH_PARENT / unmeasured axes fall back to the display limit.
+        int measured = horizontal ? imageView.getWidth() : imageView.getHeight();
+        if (measured > 0) {
+            return Math.min(measured, displayLimit);
+        }
+
+        ViewGroup.LayoutParams layoutParams = imageView.getLayoutParams();
+        if (layoutParams != null) {
+            int declared = horizontal ? layoutParams.width : layoutParams.height;
+            if (declared > 0) {
+                return Math.min(declared, displayLimit);
+            }
+        }
+
+        return displayLimit;
+    }
+
     public static void loadImageFromFile(ImageView imageView, String file, ImageLoaderCallback callback) {
         RequestBuilder<Drawable> builder = Glide
             .with(imageView)
             .load(file);
+        builder = limitToTargetSize(builder, imageView);
         loadInto(builder, imageView, true, callback, file);
     }
 
@@ -352,17 +452,26 @@ public static void loadImageFromUri(ImageView imageView, String uri, boolean cac
         RequestBuilder<Drawable> builder = Glide
             .with(imageView)
             .load(androidUri);
+        builder = limitToTargetSize(builder, imageView);
         loadInto(builder, imageView, cachingEnabled, callback, androidUri);
     }
 
     public static void loadImageFromStream(ImageView imageView, InputStream inputStream, ImageLoaderCallback callback) {
         RequestBuilder<Drawable> builder = Glide
             .with(imageView)
-            .load(inputStream)
-            .override(Target.SIZE_ORIGINAL, Target.SIZE_ORIGINAL);
+            .load(inputStream);
+        builder = limitToTargetSize(builder, imageView);
         loadInto(builder, imageView, false, callback, inputStream);
     }
 
+    public static void loadImageFromResource(ImageView imageView, int resourceId, ImageLoaderCallback callback) {
+        RequestBuilder<Drawable> builder = Glide
+            .with(imageView)
+            .load(resourceId);
+        builder = limitToTargetSize(builder, imageView);
+        loadInto(builder, imageView, true, callback, resourceId);
+    }
+
     public static void loadImageFromFont(ImageView imageView, @ColorInt int color, String glyph, Typeface typeface, float textSize, ImageLoaderCallback callback) {
         FontModel fontModel = new FontModel(color, glyph, textSize, typeface);
         RequestBuilder<Drawable> builder = Glide
@@ -380,9 +489,22 @@ public static void loadImageFromFile(Context context, String file, ImageLoaderCa
         RequestBuilder<Drawable> builder = Glide
             .with(context)
             .load(file);
+        builder = limitToDisplaySize(builder, context);
         load(builder, context, true, callback, file);
     }
 
+    public static void loadImageFromResource(Context context, int resourceId, ImageLoaderCallback callback) {
+        if (isContextDestroyed(context)) {
+            callback.onComplete(false, null, null);
+            return;
+        }
+        RequestBuilder<Drawable> builder = Glide
+            .with(context)
+            .load(resourceId);
+        builder = limitToDisplaySize(builder, context);
+        load(builder, context, true, callback, resourceId);
+    }
+
     public static void loadImageFromUri(Context context, String uri, boolean cachingEnabled, ImageLoaderCallback callback) {
         if (isContextDestroyed(context)) {
             callback.onComplete(false, null, null);
@@ -396,6 +518,7 @@ public static void loadImageFromUri(Context context, String uri, boolean caching
         RequestBuilder<Drawable> builder = Glide
             .with(context)
             .load(androidUri);
+        builder = limitToDisplaySize(builder, context);
         load(builder, context, cachingEnabled, callback, androidUri);
     }
 
@@ -406,8 +529,8 @@ public static void loadImageFromStream(Context context, InputStream inputStream,
         }
         RequestBuilder<Drawable> builder = Glide
             .with(context)
-            .load(inputStream)
-            .override(Target.SIZE_ORIGINAL, Target.SIZE_ORIGINAL);
+            .load(inputStream);
+        builder = limitToDisplaySize(builder, context);
         load(builder, context, false, callback, inputStream);
     }
 

src/Core/src/ImageSources/FileImageSourceService/FileImageSourceService.Android.cs

@@ -27,8 +27,9 @@ public partial class FileImageSourceService
 						var id = imageView.Context?.GetDrawableId(file) ?? -1;
 						if (id > 0)
 						{
-							imageView.SetImageResource(id);
-							return Task.FromResult<IImageSourceServiceResult?>(new ImageSourceServiceLoadResult());
+							var resourceCallback = new ImageLoaderCallback();
+							PlatformInterop.LoadImageFromResource(imageView, id, resourceCallback);
+							return resourceCallback.Result;
 						}
 					}
 
@@ -48,7 +49,7 @@ public partial class FileImageSourceService
 			return Task.FromResult<IImageSourceServiceResult?>(null);
 		}
 
-		public override Task<IImageSourceServiceResult<Drawable>?> GetDrawableAsync(IImageSource imageSource, Context context, CancellationToken cancellationToken = default)
+		public override async Task<IImageSourceServiceResult<Drawable>?> GetDrawableAsync(IImageSource imageSource, Context context, CancellationToken cancellationToken = default)
 		{
 			var fileImageSource = (IFileImageSource)imageSource;
 			if (!fileImageSource.IsEmpty)
@@ -62,17 +63,53 @@ public partial class FileImageSourceService
 						var id = context?.GetDrawableId(file) ?? -1;
 						if (id > 0)
 						{
-							var d = context?.GetDrawable(id);
-							if (d is not null)
-								return Task.FromResult<IImageSourceServiceResult<Drawable>?>(new ImageSourceServiceResult(d));
+							var resourceCallback = new ImageLoaderResultCallback();
+							PlatformInterop.LoadImageFromResource(context, id, resourceCallback);
+
+							var result = await resourceCallback.Result.ConfigureAwait(false);
+							if (result is null)
+							{
+								Logger?.LogWarning("Unable to load image resource '{File}'.", file);
+								return null;
+							}
+
+							// The async Glide callback is not itself cancelable, so recheck the token before
+							// returning. A superseded (canceled) resource load must NOT surface as a null result:
+							// the non-ImageView consumer (ImageSourcePartExtensions.UpdateSourceAsync) treats null as
+							// a Glide failure and calls setImage(null), clearing the newer source it already applied.
+							// Dispose the now-unneeded drawable and propagate cancellation so the caller's
+							// OperationCanceledException path leaves the newer image intact.
+							if (cancellationToken.IsCancellationRequested)
+							{
+								result.Dispose();
+								throw new OperationCanceledException(cancellationToken);
+							}
+
+							return result;
 						}
 					}
 
 					var callback = new ImageLoaderResultCallback();
 
 					PlatformInterop.LoadImageFromFile(context, file, callback);
 
-					return callback.Result;
+					var fileResult = await callback.Result.ConfigureAwait(false);
+
+					// Same cancellation handling as the resource path above: propagate cancellation (disposing
+					// the dropped drawable) instead of returning a null that a superseded load would turn into
+					// setImage(null), clearing a newer source on the non-ImageView consumer.
+					if (cancellationToken.IsCancellationRequested)
+					{
+						fileResult?.Dispose();
+						throw new OperationCanceledException(cancellationToken);
+					}
+
+					return fileResult;
+				}
+				catch (OperationCanceledException)
+				{
+					// Normal cancellation of a superseded load — propagate without logging it as a failure.
+					throw;
 				}
 				catch (Exception ex)
 				{
@@ -81,7 +118,7 @@ public partial class FileImageSourceService
 				}
 			}
 
-			return Task.FromResult<IImageSourceServiceResult<Drawable>?>(null);
+			return null;
 		}
 	}
 }

src/Core/tests/DeviceTests/Handlers/Image/ImageHandlerTests.cs

@@ -9,7 +9,6 @@
 
 #if ANDROID
 using Android.Graphics.Drawables;
-using PlatformImageType = System.Int32;
 #elif IOS || MACCATALYST
 using UIKit;
 using PlatformImageType = UIKit.UIImage;
@@ -29,7 +28,6 @@ public abstract partial class ImageHandlerTests<TImageHandler, TStub> : CoreHand
 		where TStub : StubBase, IImageStub, new()
 	{
 #if ANDROID
-		const string ImageEventAppResourceMemberName = "SetImageResource";
 		const string ImageEventCustomMemberName = "SetImageDrawable";
 #elif IOS || MACCATALYST
 		const string ImageEventAppResourceMemberName = "Image";
@@ -405,12 +403,15 @@ await InvokeOnMainThreadAsync(async () =>
 				await handler.PlatformView.AssertContainsColor(Colors.Red, MauiContext);
 
 				Assert.Single(handler.ImageEvents);
-				Assert.Equal(ImageEventAppResourceMemberName, handler.ImageEvents[0].Member);
-				var platformImage = Assert.IsType<PlatformImageType>(handler.ImageEvents[0].Value);
+				Assert.Equal(ImageEventCustomMemberName, handler.ImageEvents[0].Member);
 
 #if ANDROID
-				Assert.Equal(GetDrawableId("red"), platformImage);
+				// App-resource images now decode through Glide (to bound oversized bitmaps), which
+				// applies the decoded result via SetImageDrawable instead of the native SetImageResource(id).
+				// The rendered color is already asserted above via PlatformView.AssertContainsColor.
+				Assert.IsAssignableFrom<BitmapDrawable>(handler.ImageEvents[0].Value);
 #elif IOS || MACCATALYST
+				var platformImage = Assert.IsType<PlatformImageType>(handler.ImageEvents[0].Value);
 				await platformImage.AssertContainsColor(Colors.Red.ToPlatform()).ConfigureAwait(false);
 #endif
 			});
@@ -447,12 +448,15 @@ await InvokeOnMainThreadAsync(async () =>
 				await handler.PlatformView.AssertContainsColor(Colors.Blue, MauiContext);
 
 				Assert.Single(handler.ImageEvents);
-				Assert.Equal(ImageEventAppResourceMemberName, handler.ImageEvents[0].Member);
-				var platformImage = Assert.IsType<PlatformImageType>(handler.ImageEvents[0].Value);
+				Assert.Equal(ImageEventCustomMemberName, handler.ImageEvents[0].Member);
 
 #if ANDROID
-				Assert.Equal(GetDrawableId("blue"), platformImage);
+				// App-resource images now decode through Glide (to bound oversized bitmaps), which
+				// applies the decoded result via SetImageDrawable instead of the native SetImageResource(id).
+				// The rendered color is already asserted above via PlatformView.AssertContainsColor.
+				Assert.IsAssignableFrom<BitmapDrawable>(handler.ImageEvents[0].Value);
 #elif IOS || MACCATALYST
+				var platformImage = Assert.IsType<PlatformImageType>(handler.ImageEvents[0].Value);
 				await platformImage.AssertContainsColor(Colors.Blue.ToPlatform()).ConfigureAwait(false);
 #endif
 			});
@@ -516,11 +520,6 @@ protected TCustomHandler CreateHandler<TCustomHandler>(IView view)
 			return handler;
 		}
 
-#if ANDROID
-		static int GetDrawableId(string image) =>
-			MauiProgram.DefaultContext.Resources.GetDrawableId(MauiProgram.DefaultContext.PackageName, image);
-#endif
-
 		[Fact(
 #if WINDOWS
 			Skip = "To be implemented on Windows."