fix(notify): bound RowStride before the int64 guard

The dimension cap closed the named overflow, but stride was still
r.RowStride whenever RowStride >= Width*Channels, and asInt accepts an
int64 wire value. With Width=2, Height=2, RowStride=MaxInt the int64
need product wraps negative, the guard passes, and r.Data[y*stride:]
panics at y=1. Reject a negative stride and any stride above
Width*Channels+4096, which is the real packing plus alignment slack.
After the cap and this bound neither need nor y*stride can overflow, so
the comment now says so.

1 files changed, 17 insertions, 0 deletions

diff --git a/internal/notify/image_test.go b/internal/notify/image_test.go
index 00dfb33..4f8c7ce 100644
--- a/internal/notify/image_test.go
+++ b/internal/notify/image_test.go
@@ -16,6 +16,7 @@ import (
 	"image"
 	"image/color"
 	"image/png"
+	"math"
 	"testing"
 
 	"github.com/godbus/dbus/v5"
@@ -161,4 +162,20 @@ func TestRawImagePNGRejectsBadData(t *testing.T) {
 	}).PNG(); err == nil {
 		t.Fatal("oversized dimensions must error")
 	}
+	// Small dimensions but RowStride at MaxInt: need wraps negative and the
+	// y*stride slice at y=1 panics. Must error, not panic.
+	if _, err := (&RawImage{
+		Width: 2, Height: 2, RowStride: math.MaxInt,
+		BitsPerSample: 8, Channels: 4,
+		Data: []byte{0, 0, 0, 255, 0, 0, 0, 255},
+	}).PNG(); err == nil {
+		t.Fatal("oversized rowstride must error")
+	}
+	if _, err := (&RawImage{
+		Width: 2, Height: 1, RowStride: -1,
+		BitsPerSample: 8, Channels: 4,
+		Data: []byte{0, 0, 0, 255, 0, 0, 0, 255},
+	}).PNG(); err == nil {
+		t.Fatal("negative rowstride must error")
+	}
 }