TheLanc3/rustdesk
1
0
Fork 0
mirror of https://github.com/rustdesk/rustdesk.git synced 2026-09-18 10:21:03 +03:00
Code Issues Packages Projects Releases Wiki Activity

Validate raw cursor geometry and RGBA length before decoding

Browse Source
This commit is contained in:
fufesou
2026-09-14 09:37:40 +08:00
parent 2cfbbd56b4
commit ee8c843bc4
2 changed files with 118 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
flutter/lib/models/model.dart
View File

@@ -3494,6 +3494,11 @@ class CursorModel with ChangeNotifier {
final hoty = double.parse(evt['hoty']);
final width = int.parse(evt['width']);
final height = int.parse(evt['height']);
// Bound physical allocation before density normalization or image decoding.
if (!_validCursorRasterSize(width.toDouble(), height.toDouble())) {
debugPrint('Rejected cursor $id: invalid source size ${width}x$height');
return;
}
final pixelRatio = double.tryParse(evt['scale'] ?? '0');
if (pixelRatio == null || !pixelRatio.isFinite || pixelRatio < 0 ||
(pixelRatio > 0 &&
@@ -3502,6 +3507,11 @@ class CursorModel with ChangeNotifier {
return;
}
List<dynamic> colors = json.decode(evt['colors']);
const bytesPerPixel = 4;
if (colors.length != width * height * bytesPerPixel) {
debugPrint('Rejected cursor $id: invalid RGBA length ${colors.length}');
return;
}
final rgba = Uint8List.fromList(colors.map((s) => s as int).toList());
final ui.Image? image;
final platform = parent.target?.ffiModel.pi.platform;