TheLanc3/rustdesk
1
0
Fork 0
mirror of https://github.com/rustdesk/rustdesk.git synced 2026-09-16 09:21:01 +03:00
Code Issues Packages Projects Releases Wiki Activity

Validate cursor source metadata before UI dispatch

Browse Source
This commit is contained in:
fufesou
2026-09-14 10:50:08 +08:00
parent 8f499c2eb5
commit 74c818bef9
2 changed files with 23 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
flutter/lib/models/model.dart
View File

@@ -3494,21 +3494,22 @@ class CursorModel with ChangeNotifier {
final hoty = double.parse(evt['hoty']);
final width = int.parse(evt['width']);
final height = int.parse(evt['height']);
// Bound physical allocation before density normalization or image decoding.
if (!_validCursorRasterSize(width.toDouble(), height.toDouble())) {
// Rust validates native packets; Web receives them directly from JavaScript.
if (isWeb && !_validCursorRasterSize(width.toDouble(), height.toDouble())) {
debugPrint('Rejected cursor $id: invalid source size ${width}x$height');
return;
}
final pixelRatio = double.tryParse(evt['scale'] ?? '0');
if (pixelRatio == null || !pixelRatio.isFinite || pixelRatio < 0 ||
(pixelRatio > 0 &&
!_validCursorRasterSize(width / pixelRatio, height / pixelRatio))) {
if (pixelRatio == null ||
(isWeb && (!pixelRatio.isFinite || pixelRatio < 0 ||
(pixelRatio > 0 &&
!_validCursorRasterSize(width / pixelRatio, height / pixelRatio))))) {
debugPrint('Rejected cursor $id: invalid pixel ratio ${evt['scale']}');
return;
}
List<dynamic> colors = json.decode(evt['colors']);
const bytesPerPixel = 4;
if (colors.length != width * height * bytesPerPixel) {
if (isWeb && colors.length != width * height * bytesPerPixel) {
debugPrint('Rejected cursor $id: invalid RGBA length ${colors.length}');
return;
}

16
src/client/io_loop.rs
View File

@@ -2562,6 +2562,22 @@ fn decode_cursor_data(data: CursorData) -> hbb_common::ResultType<CursorData> {
if !(1..=MAX_CURSOR_SIZE).contains(&cd.width) || !(1..=MAX_CURSOR_SIZE).contains(&cd.height) {
bail!("invalid source size {}x{}", cd.width, cd.height);
}
if !(0..cd.width).contains(&cd.hotx) || !(0..cd.height).contains(&cd.hoty) {
bail!(
"hotspot ({},{}) is outside the cursor image",
cd.hotx,
cd.hoty
);
}
// Zero preserves legacy sizing; positive density must bound the logical image too.
if !cd.scale.is_finite()
|| cd.scale < 0.0
|| (cd.scale > 0.0
&& (f64::from(cd.width) / cd.scale > f64::from(MAX_CURSOR_SIZE)
|| f64::from(cd.height) / cd.scale > f64::from(MAX_CURSOR_SIZE)))
{
bail!("invalid cursor density {}", cd.scale);
}
let expected = (cd.width as usize)
.checked_mul(cd.height as usize)
.and_then(|pixels| pixels.checked_mul(RGBA_CHANNELS))