1 files changed, 14 insertions, 4 deletions

diff --git a/internal/notify/image.go b/internal/notify/image.go
index 9dd750e..575f52b 100644
--- a/internal/notify/image.go
+++ b/internal/notify/image.go
@@ -109,10 +109,14 @@ func asInt(v any) (int, bool) {
 }
 
 // maxImageDimension caps a client-supplied width or height. A notification
-// icon is small, and the cap keeps every later width*channels and y*stride
-// product far from overflow.
+// icon is small.
 const maxImageDimension = 1 << 16
 
+// maxRowStrideSlack bounds how far RowStride may exceed the tight packing of
+// Width*Channels. Real strides are the tight width or that plus a small
+// alignment pad.
+const maxRowStrideSlack = 4096
+
 // PNG encodes the raw pixels as a PNG the renderer can load.
 func (r *RawImage) PNG() ([]byte, error) {
 	if r.Width <= 0 || r.Height <= 0 {
@@ -124,12 +128,18 @@ func (r *RawImage) PNG() ([]byte, error) {
 	if r.BitsPerSample != 8 || (r.Channels != 3 && r.Channels != 4) {
 		return nil, fmt.Errorf("notifyd: image bits=%d channels=%d", r.BitsPerSample, r.Channels)
 	}
+	// RowStride is client-supplied and may arrive as int64. A negative or
+	// absurd stride would wrap both the length guard and the y*stride slice
+	// index, so bound it before use.
 	stride := r.RowStride
+	if stride < 0 || stride > r.Width*r.Channels+maxRowStrideSlack {
+		return nil, fmt.Errorf("notifyd: image rowstride %d for %dx%d channels=%d", stride, r.Width, r.Height, r.Channels)
+	}
 	if stride < r.Width*r.Channels {
 		stride = r.Width * r.Channels
 	}
-	// int64 keeps a hostile RowStride from wrapping the length comparison
-	// negative and passing the guard.
+	// Width/Height are capped and stride is bounded, so this product and the
+	// y*stride indexing below cannot overflow.
 	need := int64(stride)*int64(r.Height-1) + int64(r.Width)*int64(r.Channels)
 	if int64(len(r.Data)) < need {
 		return nil, fmt.Errorf("notifyd: image data short: %d bytes", len(r.Data))