| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
A notification is untrusted input. RawImage.PNG computed
stride*(Height-1)+Width*Channels in int, so Width=Height=2^31-1 with
RowStride=0 wrapped the length expression negative, slipped past the
guard, and reached image.NewRGBA, which panics. The D-Bus call path has
no recover, so one malformed Notify killed the daemon. Cap Width/Height
at 1<<16 before any multiplication and compute the required byte count
in int64.
image-data, image-path and the deprecated icon_data were read as one
tier, with icon_data ahead of image-path, inverting the spec's order.
Split the deprecated key into IconDataFromHints and apply tier 1
(image-data/image_data), then image-path, then icon_data. Raw handling
is unchanged: encode, hold pendingImage, WriteImage after Add, SetImage.
|
|
TestNotifyMaterialisesImageData drives a 2x2 RGBA image-data hint
through Notify and asserts the PNG is written under the image directory
for the returned id, decodes to the right bounds, and is carried on the
re-published Popup.Image. The encode-error path now logs instead of
dropping the failure silently, matching the WriteImage branch.
|
|
The spec makes 0 mean never expire, so the test asserting a non-zero
Expires was asserting against the wrong input. -1 asks the server to
decide, which is a normal 10s at normal urgency, so the assertion holds.
Pre-existing on base a248608 and unrelated to the image support.
|
|
Notify resolves app_icon and image-path theme names, decodes image-data to
a PNG under the image directory, and re-publishes the entry with its
image path. The daemon advertises body-images, and removeImage refuses to
touch a path outside its own directory so a client's screenshot file is
never deleted.
|
|
Split the dismiss test so expiry is exercised on its own: Expire removes
the image without deleting the inert entry, and nothing asserted it.
removeImage now requires filepath.Dir(filepath.Clean(path)) to equal the
image directory, so a path carrying .. cannot reach a sibling daemon file
such as queue.json. The previous prefix test accepted it. Not exploitable
until Task 4 populates Popup.Image from a client hint, which is exactly
why the guard is fixed now.
|
|
Popup gains image, and the store calls an injected removeImage when an
entry is dismissed, evicted, replaced or expired, so a daemon-written
PNG does not outlive its balloon. The service decides what is
daemon-owned; the store only names the path.
NewStore now takes the callback as a third parameter, so the service
wires its removeImage in (unlinking only under ImagesDir) and the
existing call sites pass nil.
|
|
|
|
Notify assigns an id and publishes; a replaces_id or stack tag reuses the id.
CloseNotification closes with reason 3. The daemon claims
org.freedesktop.Notifications and exits non-zero if it cannot, which is what
happens while dunst still holds it.
|
