cursor: put an upper bound on the cursor shape size

gnif · Nov 11, 2023 · fe62103 · fe62103
1 parent 7fc35cf
commit fe62103
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/channel_cursor.c b/src/channel_cursor.c
@@ -122,6 +122,13 @@ static struct PSCursorImage * convertCursor(SpiceCursor * cursor)
   if (cursor->flags & SPICE_CURSOR_FLAGS_FROM_CACHE)
     return loadCursor(cursor->header.unique);
 
+  if (cursor->header.width > 512 || cursor->header.height > 512)
+  {
+    PS_LOG_ERROR("Unexpected cursor size: %ux%u",
+        cursor->header.width, cursor->header.height);
+    return NULL;
+  }
+
   size_t bufferSize = cursorBufferSize(&cursor->header);
   struct PSCursorImage * node = malloc(sizeof(struct PSCursorImage) + bufferSize);