| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
The dimension cap closed the named overflow, but stride was still
r.RowStride whenever RowStride >= Width*Channels, and asInt accepts an
int64 wire value. With Width=2, Height=2, RowStride=MaxInt the int64
need product wraps negative, the guard passes, and r.Data[y*stride:]
panics at y=1. Reject a negative stride and any stride above
Width*Channels+4096, which is the real packing plus alignment slack.
After the cap and this bound neither need nor y*stride can overflow, so
the comment now says so.
|
|
A notification is untrusted input. RawImage.PNG computed
stride*(Height-1)+Width*Channels in int, so Width=Height=2^31-1 with
RowStride=0 wrapped the length expression negative, slipped past the
guard, and reached image.NewRGBA, which panics. The D-Bus call path has
no recover, so one malformed Notify killed the daemon. Cap Width/Height
at 1<<16 before any multiplication and compute the required byte count
in int64.
image-data, image-path and the deprecated icon_data were read as one
tier, with icon_data ahead of image-path, inverting the spec's order.
Split the deprecated key into IconDataFromHints and apply tier 1
(image-data/image_data), then image-path, then icon_data. Raw handling
is unchanged: encode, hold pendingImage, WriteImage after Add, SetImage.
|
|
The stride test was Height 1, so the second row and the padding beyond the
used pixels were never reached and rowstride was untested despite the
comment. It is now 2x2 with RowStride 12 and asserts a pixel in row 1,
which fails if the stride is ignored (verified by mutation). Add the
3-channel opaque encode and the short-data rejection, both explicit
requirements of the image-data contract.
|
|
image-data (and the deprecated icon_data) is the (iiibiiay) struct; the
PNG encoder honours rowstride and both 3- and 4-channel data. The path
and data readers are pure, so the service can apply the spec's priority
and the store stays free of image handling.
|
