mirror of
https://github.com/storytold/vectorcraft.git
synced 2026-10-24 09:46:59 -06:00
Martin Vlach
bf6692ae82
GradientMesh::is_valid and the two mesh envelope checks (envelope_grid and the envelope's surface) compare the number of points with (rows + 1) × (cols + 1), multiplying the document's u32 rows and columns unchecked. With u32::MAX rows and columns the product is 2^64: debug builds panic on the overflow and release builds wrap it to 0, so a mesh or a mesh envelope without points passes as valid. Selecting it, Outline view, hit testing and export then index points that aren't there (the mesh lines, outline and edges), tessellating it asks for an impossible capacity, and a mesh envelope with handles to fill in loops 2^64 times making them until memory runs out. On wasm32, where usize has 32 bits, 65,535 rows and columns are enough, and a panic there aborts the web app. The three checks now share grid_len, which counts the points with checked arithmetic and gives None when the count doesn't fit in a usize: a grid that can't be counted matches no point list, so it is malformed like any other wrong count. The test checks that a u32::MAX × u32::MAX mesh without points isn't valid and has no lines, outline or quads, that envelope_grid refuses those counts, and that a mesh envelope with them leaves art in place. Reported-by: BS.ehlas.cz