Currently when an image exceeds Settings::maximumDecodedSize() we continue the load. Instead we should cancel the load for such an image. Note, we may want to differentiate between an image that is loaded as a sub resource of a page from an image loaded as a document (i.e. navigating to an image resource directly) and have different maximum decoded size limits.
I noticed this bug when analyzing the cause for bug #127029.
We decided to remove the setting Settings::maximumDecodedSize() and its related logic in bug #131057 as it has various shortcomings, including the one represented by this bug. Should it turn out that we need such a setting then we should look to implement it again taking care to address this bug among other issues.