From: Florian Müllner <fmuellner@gnome.org>
Date: Thu, 20 Aug 2026 23:13:09 +0000 (+0200)
Subject: shell/util: Validate create_pixbuf_from_data() parameters
X-Git-Tag: archive/raspbian/50.5-1+rpi1^2~6^2^2~5
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=d710f00a56522a72b9b27e3c0feca3b70dee71cf;p=gnome-shell.git

shell/util: Validate create_pixbuf_from_data() parameters

The function is used to create a pixbuf from image data for
a search provider or notification client.

Without validation, a malicious client can provide a data array that
is smaller than the size required by the passed image parameters,
which will eventually result in out-of-bound reads.

Closes: https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/9365
Part-of: <https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/4418>
(cherry picked from commit 8a3f208d0123b4831b1a4ba1040acc4f9091d465)
---

diff --git a/src/shell-util.c b/src/shell-util.c
index 2ccf62426..7b4f88b5b 100644
--- a/src/shell-util.c
+++ b/src/shell-util.c
@@ -350,6 +350,32 @@ shell_util_create_pixbuf_from_data (const guchar      *data,
                                     int                height,
                                     int                rowstride)
 {
+  g_return_val_if_fail (data != NULL, NULL);
+  g_return_val_if_fail (colorspace == GDK_COLORSPACE_RGB, NULL);
+  g_return_val_if_fail (bits_per_sample == 8, NULL);
+  g_return_val_if_fail (width > 0, NULL);
+  g_return_val_if_fail (height > 0, NULL);
+
+  unsigned int channels;
+  unsigned int row_min;
+  size_t required;
+
+  channels = has_alpha ? 4 : 3;
+
+  /* Validate that the data array length is big enough for
+   * the provided pixbuf parameters;
+   * take into account that the actual rowstride may be bigger
+   * than the minimum requirement, and that the last row may
+   * not be as wide as the full rowstride.
+   * See https://docs.gtk.org/gdk-pixbuf/class.Pixbuf.html#image-data
+   */
+
+  row_min = width * ((channels * bits_per_sample + 7) / 8);
+  g_return_val_if_fail (rowstride >= row_min, NULL);
+
+  required = (height - 1) * rowstride + row_min;
+  g_return_val_if_fail (len >= required, NULL);
+
   return gdk_pixbuf_new_from_data (data, colorspace, has_alpha,
                                    bits_per_sample, width, height, rowstride,
                                    (GdkPixbufDestroyNotify) g_free, NULL);