diff --git a/CHANGELOG.md b/CHANGELOG.md index 464f096f..ee6a979d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -82,10 +82,13 @@ * DECCRA not clamping or verifying the destination rectangle ([#2352][2352]). * Empty selection clearing the clipboard ([#2327][2327]). +* Sixel image max size not clamped, causing foot to crash on very + large sixel images ([#2343][2343]). [2353]: https://codeberg.org/dnkl/foot/issues/2353 [2352]: https://codeberg.org/dnkl/foot/issues/2352 [2327]: https://codeberg.org/dnkl/foot/issues/2327 +[2343]: https://codeberg.org/dnkl/foot/issues/2343 ### Security diff --git a/sixel.c b/sixel.c index 187f1348..1db6336d 100644 --- a/sixel.c +++ b/sixel.c @@ -2207,9 +2207,11 @@ sixel_geometry_reset(struct terminal *term) void sixel_geometry_set(struct terminal *term, unsigned width, unsigned height) { - LOG_DBG("sixel geometry set to %ux%u", width, height); - term->sixel.max_width = width; - term->sixel.max_height = height; + const unsigned new_width = min(width, SIXEL_MAX_WIDTH); + const unsigned new_height = min(height, SIXEL_MAX_HEIGHT); + LOG_DBG("sixel geometry set to %ux%u", new_width, new_height); + term->sixel.max_width = new_width; + term->sixel.max_height = new_height; sixel_geometry_report_current(term); } diff --git a/sixel.h b/sixel.h index ab8a5050..5c18da1c 100644 --- a/sixel.h +++ b/sixel.h @@ -2,10 +2,14 @@ #include "terminal.h" -#define SIXEL_MAX_COLORS 1024u -#define SIXEL_MAX_WIDTH 10000u +#define SIXEL_MAX_COLORS 1024u +#define SIXEL_MAX_WIDTH 10000u #define SIXEL_MAX_HEIGHT 10000u +static_assert(SIXEL_MAX_WIDTH * SIXEL_MAX_HEIGHT == + (size_t)SIXEL_MAX_WIDTH * SIXEL_MAX_HEIGHT, + "sixel max size triggers integer overflow"); + typedef void (*sixel_put)(struct terminal *term, uint8_t c); void sixel_fini(struct terminal *term);