Graphics protocol: Fix crash when handling invalid PNG image with direct transmission

This commit is contained in:
Kovid Goyal
2026-03-21 17:23:06 +05:30
parent bd2a5cccfb
commit 48ab623f59
2 changed files with 3 additions and 1 deletions

View File

@@ -170,6 +170,8 @@ Detailed list of changes
- Fix thickness of diagonal lines in box drawing characters not the same as horizontal/vertical lines (:iss:`9719`)
- Graphics protocol: Fix crash when handling invalid PNG image with direct transmission
0.46.2 [2026-03-21]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

View File

@@ -555,7 +555,7 @@ load_image_data(GraphicsManager *self, Image *img, const GraphicsCommand *g, con
case 'd': // direct
if (load_data->buf_capacity - load_data->buf_used < g->payload_sz) {
if (load_data->buf_used + g->payload_sz > MAX_DATA_SZ || data_fmt != PNG) ABRT("EFBIG", "Too much data");
load_data->buf_capacity = MIN(2 * load_data->buf_capacity, MAX_DATA_SZ);
load_data->buf_capacity = MAX(MIN(2 * load_data->buf_capacity, MAX_DATA_SZ), load_data->buf_used + g->payload_sz);
load_data->buf = realloc(load_data->buf, load_data->buf_capacity);
if (load_data->buf == NULL) {
load_data->buf_capacity = 0; load_data->buf_used = 0;