From fb45e7ecb5f075efc5b1f25a9c0cabfe6e1e0763 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Sun, 15 Nov 2026 00:37:40 +0000 Subject: [PATCH] fix(render): validate dimensions in PNG header estimate --- crates/render/src/paint.rs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/crates/render/src/paint.rs b/crates/render/src/paint.rs index 4dd1253bee..83f743b92b 100644 --- a/crates/render/src/paint.rs +++ b/crates/render/src/paint.rs @@ -317,7 +317,11 @@ fn png_row_scratch_from_header(bytes: &[u8], width: u32, height: u32, total_byte match kind { b"IHDR" if len == 13 && !header => { header = true; - if u32::from_be_bytes(data[..4].try_into().ok()?) != width || data[12] != 0 { + if at != 8 + || u32::from_be_bytes(data[..4].try_into().ok()?) != width + || u32::from_be_bytes(data[4..8].try_into().ok()?) != height + || data[12] != 0 + { return None; } }