jeka/utun2
1
0 Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Bound avatar manifest sizes before numeric conversion

Browse Source
This commit is contained in:
evgeny committed 2026-10-06 21:34:15 +02:00
1 parent 3e1cc8af85
commit 52f4628fe0
2 files changed
+12 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tools/chatgui/src/avatars/avatarcache.cpp
+3 -2
View File
@@ -51,13 +51,14 @@ AvatarCache::Result AvatarCache::readObject(const QString& path, const QString&
if (name.endsWith(".json")) {
const QJsonObject o = QJsonDocument::fromJson(bytes).object(); Record& r = result.record;
r.original = o["original"].toString(); r.preview = o["preview"].toString();
r.originalBytes = qint64(o["original_bytes"].toDouble()); r.previewBytes = qint64(o["preview_bytes"].toDouble());
r.originalBytes = qint64(qBound(-1.0, o["original_bytes"].toDouble(-1), double(OriginalMaxBytes) + 1));
r.previewBytes = qint64(qBound(-1.0, o["preview_bytes"].toDouble(-1), double(MaxBytes) + 1));
r.size = QSize(o["width"].toInt(), o["height"].toInt());
r.crop = QRectF(o["x"].toDouble(-1), o["y"].toDouble(-1), o["w"].toDouble(), o["h"].toDouble());
const double pixelW = r.crop.width() * r.size.width(), pixelH = r.crop.height() * r.size.height();
if (o["version"].toInt() != 1 || !mf_avatar_file_valid(r.original.toLatin1().constData()) || r.original.endsWith(".json") ||
!mf_avatar_file_valid(r.preview.toLatin1().constData()) || !r.preview.endsWith(".webp") ||
!r.size.isValid() || qint64(r.size.width()) * r.size.height() > 16 * 1024 * 1024 ||
r.size.width() <= 0 || r.size.height() <= 0 || qint64(r.size.width()) * r.size.height() > 16 * 1024 * 1024 ||
r.originalBytes < 1 || r.originalBytes > OriginalMaxBytes || r.previewBytes < 1 || r.previewBytes > MaxBytes ||
!r.crop.isValid() || !QRectF(0, 0, 1, 1).contains(r.crop) || qAbs(pixelW - pixelH) > 2) {
result.error = "invalid avatar manifest"; r = {};