RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 08:58:11 +00:00
Code Issues Activity Actions

LibGUI+LibGfx+WindowServer: Sanity check window size dimensions

Browse source 
Previous to this commit, if a `Window` wanted to set its width or height
greater than `INT16_MAX` (32768), both the application owning the Window
and the WindowServer would crash.

The root of this issue is that `size_would_overflow` check in `Bitmap`
has checks for `INT16_MAX`, and `Window.cpp:786` that is called by
`Gfx::Bitmap::create_with_anonymous_buffer` would get null back, then
causing a chain of events resulting in crashes.

Crashes can still occur but with `VERIFY` and `did_misbehave` the
causes of the crash can be more readily identified.
This commit is contained in:
Matthew Jones 2021-06-02 15:06:59 -06:00 • committed by Linus Groh
parent 839aad6e5b
commit ea4116f5bd
3 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Userland/Services/WindowServer/ClientConnection.cpp
View file

@ -363,6 +363,10 @@ Messages::WindowServer::SetWindowRectResponse ClientConnection::set_window_rect(
dbgln("ClientConnection: Ignoring SetWindowRect request for fullscreen window");
return nullptr;
}
if (rect.width() > INT16_MAX || rect.height() > INT16_MAX) {
did_misbehave(String::formatted("SetWindowRect: Bad window sizing(width={}, height={}), dimension exceeds INT16_MAX", rect.width(), rect.height()).characters());
return nullptr;
}
if (rect.location() != window.rect().location()) {
window.set_default_positioned(false);