[client] cursor: validate shape geometry

This commit is contained in:
Geoffrey McRae
2026-08-24 12:32:18 +10:00
parent 8cb6a6873e
commit 50b1c9b2e2
5 changed files with 251 additions and 85 deletions

View File

@@ -494,16 +494,12 @@ static void setCommandSource(RenderCommand * cmd, RenderQueueSource source,
static bool copyCursorImage(RenderCommand * cmd, const void * data)
{
if (!data || cmd->cursorImage.width <= 0 ||
cmd->cursorImage.height <= 0 || cmd->cursorImage.pitch <= 0)
size_t size;
if (!data || !lg_rendererCursorValidate(cmd->cursorImage.type,
cmd->cursorImage.width, cmd->cursorImage.height,
cmd->cursorImage.pitch, &size))
return false;
if ((size_t)cmd->cursorImage.height >
SIZE_MAX / (size_t)cmd->cursorImage.pitch)
return false;
const size_t size =
(size_t)cmd->cursorImage.height * (size_t)cmd->cursorImage.pitch;
cmd->cursorImage.data = malloc(size);
if (!cmd->cursorImage.data)
return false;