ayo/kitty
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Graphics protocol: Fix crash when handling invalid PNG image with direct transmission

Browse source
This commit is contained in:
Kovid Goyal 2026-03-21 17:23:06 +05:30
parent bd2a5cccfb
commit 48ab623f59
No known key found for this signature in database
GPG key ID: 06BC317B515ACE7C
2 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docs/changelog.rst
View file

@ -170,6 +170,8 @@ Detailed list of changes
- Fix thickness of diagonal lines in box drawing characters not the same as horizontal/vertical lines (:iss:`9719`) - Fix thickness of diagonal lines in box drawing characters not the same as horizontal/vertical lines (:iss:`9719`)
- Graphics protocol: Fix crash when handling invalid PNG image with direct transmission
0.46.2 [2026-03-21] 0.46.2 [2026-03-21]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2
kitty/graphics.c
View file

@ -555,7 +555,7 @@ load_image_data(GraphicsManager *self, Image *img, const GraphicsCommand *g, con
case 'd': // direct case 'd': // direct
if (load_data->buf_capacity - load_data->buf_used < g->payload_sz) { if (load_data->buf_capacity - load_data->buf_used < g->payload_sz) {
if (load_data->buf_used + g->payload_sz > MAX_DATA_SZ || data_fmt != PNG) ABRT("EFBIG", "Too much data"); if (load_data->buf_used + g->payload_sz > MAX_DATA_SZ || data_fmt != PNG) ABRT("EFBIG", "Too much data");
load_data->buf_capacity = MIN(2 * load_data->buf_capacity, MAX_DATA_SZ); load_data->buf_capacity = MAX(MIN(2 * load_data->buf_capacity, MAX_DATA_SZ), load_data->buf_used + g->payload_sz);
load_data->buf = realloc(load_data->buf, load_data->buf_capacity); load_data->buf = realloc(load_data->buf, load_data->buf_capacity);
if (load_data->buf == NULL) { if (load_data->buf == NULL) {
load_data->buf_capacity = 0; load_data->buf_used = 0; load_data->buf_capacity = 0; load_data->buf_used = 0;