8e2eee7654
Problem: A borked ImageDecoder could send a BitmapSequence over IPC with metadata for a (large) bitmap while shipping a too-small backing buffer. Decoding it produced a Gfx::Bitmap that reported the (large) geometry but pointed at the too-small buffer — making the first write go OOB. Cause: BitmapSequence decode reads size_in_bytes and the bitmap geometry as independent fields, and only checked if size_in_bytes matched the transferred buffer size — never that either is consistent with the geometry. The single-frame fast path then handed the buffer to Bitmap::create_with_anonymous_buffer with no verification. Fix: Make the two bitmap factories that take externally-provided storage enforce that it covers the geometry. create_with_anonymous_buffer now fails with buffers smaller than the minimum expected size_in_bytes — and create_with_raw_data similarly rejects data too small for the geometry. Fixes https://github.com/LadybirdBrowser/ladybird/issues/10036 |
||
|---|---|---|
| .. | ||
| test-inputs | ||
| BenchmarkJPEGLoader.cpp | ||
| CMakeLists.txt | ||
| TestBitmapExport.cpp | ||
| TestBitmapSequence.cpp | ||
| TestColor.cpp | ||
| TestImageDecoder.cpp | ||
| TestImageWriter.cpp | ||
| TestQuad.cpp | ||
| TestRect.cpp | ||
| TestShareableBitmap.cpp | ||
| TestWOFF.cpp | ||
| TestWOFF2.cpp | ||
| TestYUVData.cpp | ||