mirrors/kitty
1
0
Fork 0
mirror of https://github.com/kovidgoyal/kitty synced 2026-07-02 20:53:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

Graphics protocol: Fix crash when handling invalid offset values in graphics compose commands

Browse Source
This commit is contained in:
Kovid Goyal
2026-03-22 21:49:12 +05:30
parent f7626c7472
commit e9661f0f3a
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/changelog.rst
View File

@@ -172,6 +172,8 @@ Detailed list of changes
- Graphics protocol: Fix crash when handling invalid PNG image with direct transmission - Graphics protocol: Fix crash when handling invalid PNG image with direct transmission
- Graphics protocol: Fix crash when handling invalid offset values in graphics compose commands
- X11: Fix a regression in the previous release that caused an occasional crash on input device removal (:iss:`9723`) - X11: Fix a regression in the previous release that caused an occasional crash on input device removal (:iss:`9723`)
0.46.2 [2026-03-21] 0.46.2 [2026-03-21]

7
kitty/graphics.c
View File

@@ -1827,9 +1827,10 @@ handle_compose_command(GraphicsManager *self, bool *is_dirty, const GraphicsComm
set_command_failed_response("ENOENT", "No destination frame number %u exists in image id: %u\n", g->other_frame_number, img->client_id); set_command_failed_response("ENOENT", "No destination frame number %u exists in image id: %u\n", g->other_frame_number, img->client_id);
return; return;
} }
const unsigned int width = g->width ? g->width : img->width; // Use uint64_t to avoid overflow when testing for validity. All dimensions are 32bit numbers.
const unsigned int height = g->height ? g->height : img->height; const uint64_t width = g->width ? g->width : img->width;
const unsigned int dest_x = g->x_offset, dest_y = g->y_offset, src_x = g->cell_x_offset, src_y = g->cell_y_offset; const uint64_t height = g->height ? g->height : img->height;
const uint64_t dest_x = g->x_offset, dest_y = g->y_offset, src_x = g->cell_x_offset, src_y = g->cell_y_offset;
if (dest_x + width > img->width || dest_y + height > img->height) { if (dest_x + width > img->width || dest_y + height > img->height) {
set_command_failed_response("EINVAL", "The destination rectangle is out of bounds"); set_command_failed_response("EINVAL", "The destination rectangle is out of bounds");
return; return;