From eec67f2e3c226470ee0a1a45a28346d660b75a27 Mon Sep 17 00:00:00 2001 From: anupamme Date: Mon, 14 Sep 2026 15:45:17 +0000 Subject: [PATCH] fix: add buffer-length check in capture-menger.c The capture-menger --- .../menger/tools/native/headless/capture-menger.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/adapters/menger/tools/native/headless/capture-menger.c b/src/adapters/menger/tools/native/headless/capture-menger.c index 881893b..8e33401 100644 --- a/src/adapters/menger/tools/native/headless/capture-menger.c +++ b/src/adapters/menger/tools/native/headless/capture-menger.c @@ -168,9 +168,16 @@ write_renderer(const char *directory, int width, int height) static int write_ppm(const char *path, int width, int height) { - unsigned char *rgba = malloc((size_t)width * (size_t)height * 4); - unsigned char *row = malloc((size_t)width * 3); + unsigned char *rgba; + unsigned char *row; FILE *stream; + if (width <= 0 || height <= 0 || + (size_t)width > SIZE_MAX / 4 / (size_t)height) { + fprintf(stderr, "capture dimensions too large\n"); + abort(); + } + rgba = malloc((size_t)width * (size_t)height * 4); + row = malloc((size_t)width * 3); if (!rgba || !row) abort(); glFinish(); glPixelStorei(GL_PACK_ALIGNMENT, 1);