RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 11:28:12 +00:00
Code Issues Activity Actions

LibGfx: Don't allow creating bitmaps whose sizes would overflow

Browse source 
If the area or size_in_bytes calculation for a Gfx::Bitmap would
overflow, we now refuse to create such a bitmap and return nullptr.

Thanks to @itamar8910 for finding this! :^)
This commit is contained in:
Andreas Kling 2020-04-15 11:57:24 +02:00
parent a8406aa117
commit 228ace854c
5 changed files with 62 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Libraries/LibGUI/Window.cpp
View file

@ -251,10 +251,12 @@ void Window::event(Core::Event& event)
bool created_new_backing_store = !m_back_bitmap;
if (!m_back_bitmap) {
m_back_bitmap = create_backing_bitmap(paint_event.window_size());
ASSERT(m_back_bitmap);
} else if (m_double_buffering_enabled) {
bool still_has_pixels = m_back_bitmap->shared_buffer()->set_nonvolatile();
if (!still_has_pixels) {
m_back_bitmap = create_backing_bitmap(paint_event.window_size());
ASSERT(m_back_bitmap);
created_new_backing_store = true;
}
}
@ -514,6 +516,7 @@ void Window::flip(const Vector<Gfx::Rect, 32>& dirty_rects)
if (!m_back_bitmap || m_back_bitmap->size() != m_front_bitmap->size()) {
m_back_bitmap = create_backing_bitmap(m_front_bitmap->size());
ASSERT(m_back_bitmap);
memcpy(m_back_bitmap->scanline(0), m_front_bitmap->scanline(0), m_front_bitmap->size_in_bytes());
m_back_bitmap->shared_buffer()->set_volatile();
return;
@ -527,7 +530,7 @@ void Window::flip(const Vector<Gfx::Rect, 32>& dirty_rects)
m_back_bitmap->shared_buffer()->set_volatile();
}
NonnullRefPtr<Gfx::Bitmap> Window::create_shared_bitmap(Gfx::BitmapFormat format, const Gfx::Size& size)
RefPtr<Gfx::Bitmap> Window::create_shared_bitmap(Gfx::BitmapFormat format, const Gfx::Size& size)
{
ASSERT(WindowServerConnection::the().server_pid());
ASSERT(!size.is_empty());
@ -539,7 +542,7 @@ NonnullRefPtr<Gfx::Bitmap> Window::create_shared_bitmap(Gfx::BitmapFormat format
return Gfx::Bitmap::create_with_shared_buffer(format, *shared_buffer, size);
}
NonnullRefPtr<Gfx::Bitmap> Window::create_backing_bitmap(const Gfx::Size& size)
RefPtr<Gfx::Bitmap> Window::create_backing_bitmap(const Gfx::Size& size)
{
auto format = m_has_alpha_channel ? Gfx::BitmapFormat::RGBA32 : Gfx::BitmapFormat::RGB32;
return create_shared_bitmap(format, size);
@ -561,6 +564,7 @@ void Window::set_icon(const Gfx::Bitmap* icon)
return;
m_icon = create_shared_bitmap(Gfx::BitmapFormat::RGBA32, icon->size());
ASSERT(m_icon);
{
Painter painter(*m_icon);
painter.blit({ 0, 0 }, *icon, icon->rect());