From d5812ffa717cad99e12752b719a024f06b72b6af Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Tue, 15 Sep 2026 18:11:12 +0200 Subject: fix(notify): bound RowStride before the int64 guard The dimension cap closed the named overflow, but stride was still r.RowStride whenever RowStride >= Width*Channels, and asInt accepts an int64 wire value. With Width=2, Height=2, RowStride=MaxInt the int64 need product wraps negative, the guard passes, and r.Data[y*stride:] panics at y=1. Reject a negative stride and any stride above Width*Channels+4096, which is the real packing plus alignment slack. After the cap and this bound neither need nor y*stride can overflow, so the comment now says so. --- internal/notify/image_test.go | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'internal/notify/image_test.go') diff --git a/internal/notify/image_test.go b/internal/notify/image_test.go index 00dfb33..4f8c7ce 100644 --- a/internal/notify/image_test.go +++ b/internal/notify/image_test.go @@ -16,6 +16,7 @@ import ( "image" "image/color" "image/png" + "math" "testing" "github.com/godbus/dbus/v5" @@ -161,4 +162,20 @@ func TestRawImagePNGRejectsBadData(t *testing.T) { }).PNG(); err == nil { t.Fatal("oversized dimensions must error") } + // Small dimensions but RowStride at MaxInt: need wraps negative and the + // y*stride slice at y=1 panics. Must error, not panic. + if _, err := (&RawImage{ + Width: 2, Height: 2, RowStride: math.MaxInt, + BitsPerSample: 8, Channels: 4, + Data: []byte{0, 0, 0, 255, 0, 0, 0, 255}, + }).PNG(); err == nil { + t.Fatal("oversized rowstride must error") + } + if _, err := (&RawImage{ + Width: 2, Height: 1, RowStride: -1, + BitsPerSample: 8, Channels: 4, + Data: []byte{0, 0, 0, 255, 0, 0, 0, 255}, + }).PNG(); err == nil { + t.Fatal("negative rowstride must error") + } } -- cgit v1.2.3