Validating only file size is insufficient: an attacker can craft an image that is tiny on disk but huge in pixels (an 'image bomb'), crashing the image processor. Always validate dimensions in addition to size, conditionally on the MIME type being an image.