8e2eee7654
Problem: A borked ImageDecoder could send a BitmapSequence over IPC with metadata for a (large) bitmap while shipping a too-small backing buffer. Decoding it produced a Gfx::Bitmap that reported the (large) geometry but pointed at the too-small buffer — making the first write go OOB. Cause: BitmapSequence decode reads size_in_bytes and the bitmap geometry as independent fields, and only checked if size_in_bytes matched the transferred buffer size — never that either is consistent with the geometry. The single-frame fast path then handed the buffer to Bitmap::create_with_anonymous_buffer with no verification. Fix: Make the two bitmap factories that take externally-provided storage enforce that it covers the geometry. create_with_anonymous_buffer now fails with buffers smaller than the minimum expected size_in_bytes — and create_with_raw_data similarly rejects data too small for the geometry. Fixes https://github.com/LadybirdBrowser/ladybird/issues/10036
23 lines
693 B
CMake
23 lines
693 B
CMake
set(TEST_SOURCES
|
|
BenchmarkJPEGLoader.cpp
|
|
TestBitmapExport.cpp
|
|
TestColor.cpp
|
|
TestImageDecoder.cpp
|
|
TestImageWriter.cpp
|
|
TestQuad.cpp
|
|
TestRect.cpp
|
|
TestWOFF.cpp
|
|
TestWOFF2.cpp
|
|
)
|
|
|
|
foreach(source IN LISTS TEST_SOURCES)
|
|
ladybird_test("${source}" LibGfx LIBS LibGfx)
|
|
endforeach()
|
|
|
|
target_link_libraries(BenchmarkJPEGLoader PRIVATE LibImageDecoders)
|
|
target_link_libraries(TestImageDecoder PRIVATE LibImageDecoders)
|
|
target_link_libraries(TestImageWriter PRIVATE LibImageDecoders)
|
|
|
|
ladybird_test(TestBitmapSequence.cpp LibGfx LIBS LibGfx LibIPC)
|
|
ladybird_test(TestShareableBitmap.cpp LibGfx LIBS LibGfx LibIPC)
|
|
ladybird_test(TestYUVData.cpp LibGfx LIBS LibGfx skia)
|