Bug 1846694: Additional validation in RecordedSourceSurfaceCreation. …

…r=gfx-reviewers,jrmuizel Differential Revision: https://phabricator.services.mozilla.com/D185354
mozilla · Aug 10, 2023 · 967de2e · 967de2e
1 parent 129c54f
commit 967de2e
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/gfx/2d/RecordedEventImpl.h b/gfx/2d/RecordedEventImpl.h
@@ -3206,6 +3206,13 @@ RecordedSourceSurfaceCreation::RecordedSourceSurfaceCreation(S& aStream)
   ReadElement(aStream, mSize);
   ReadElementConstrained(aStream, mFormat, SurfaceFormat::A8R8G8B8_UINT32,
                          SurfaceFormat::UNKNOWN);
+
+  if (!Factory::AllowedSurfaceSize(mSize)) {
+    gfxCriticalNote << "RecordedSourceSurfaceCreation read invalid size "
+                    << mSize;
+    aStream.SetIsBad();
+  }
+
   if (!aStream.good()) {
     return;
   }