shell/util: Validate create_pixbuf_from_data() parameters

The function is used to create a pixbuf from image data for
a search provider or notification client.

Without validation, a malicious client can provide a data array that
is smaller than the size required by the passed image parameters,
which will eventually result in out-of-bound reads.

Closes: https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/9365
Part-of: <https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/4418>
(cherry picked from commit 8a3f208d0123b4831b1a4ba1040acc4f9091d465)

diff --git a/src/shell-util.c b/src/shell-util.c
index 2ccf6242647307ca31dc2d2c185c1c7a3ef84843..7b4f88b5b95382764b2a4436cdbdc8ad8d39b176 100644 (file)
--- a/src/shell-util.c
+++ b/src/shell-util.c
@@ -350,6 +350,32 @@ shell_util_create_pixbuf_from_data (const guchar      *data,
                                     int                height,
                                     int                rowstride)
 {
+  g_return_val_if_fail (data != NULL, NULL);
+  g_return_val_if_fail (colorspace == GDK_COLORSPACE_RGB, NULL);
+  g_return_val_if_fail (bits_per_sample == 8, NULL);
+  g_return_val_if_fail (width > 0, NULL);
+  g_return_val_if_fail (height > 0, NULL);
+
+  unsigned int channels;
+  unsigned int row_min;
+  size_t required;
+
+  channels = has_alpha ? 4 : 3;
+
+  /* Validate that the data array length is big enough for
+   * the provided pixbuf parameters;
+   * take into account that the actual rowstride may be bigger
+   * than the minimum requirement, and that the last row may
+   * not be as wide as the full rowstride.
+   * See https://docs.gtk.org/gdk-pixbuf/class.Pixbuf.html#image-data
+   */
+
+  row_min = width * ((channels * bits_per_sample + 7) / 8);
+  g_return_val_if_fail (rowstride >= row_min, NULL);
+
+  required = (height - 1) * rowstride + row_min;
+  g_return_val_if_fail (len >= required, NULL);
+
   return gdk_pixbuf_new_from_data (data, colorspace, has_alpha,
                                    bits_per_sample, width, height, rowstride,
                                    (GdkPixbufDestroyNotify) g_free, NULL);