From d339053ea6d28f304df8b9639a4a4ef0b9ca278b Mon Sep 17 00:00:00 2001 From: Swung0x48 Date: Sun, 20 Sep 2026 12:51:17 -0400 Subject: [PATCH] [Magma] reject truncated or overflowing RGB staging before expansion --- .../DirectVulkan/Renderer/VkTextureManager.cpp | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.cpp b/MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.cpp index b9ed98f7..ff057f63 100644 --- a/MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.cpp +++ b/MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.cpp @@ -460,8 +460,16 @@ namespace MobileGL::MG_Backend::DirectVulkan { MOBILEGL_ASSERT(formatInfo.componentByteCount > 0, "ExpandRgbSourceToRgba: invalid component size for expanded RGB format"); + if (!source || texelSize.x() <= 0 || texelSize.y() <= 0 || !formatInfo.componentByteCount || + formatInfo.componentByteCount > formatInfo.alphaBytes.size()) return false; const SizeT depth = static_cast(std::max(texelSize.z(), 1)); - const SizeT pixelCount = static_cast(texelSize.x()) * static_cast(texelSize.y()) * depth; + const SizeT width = static_cast(texelSize.x()); + const SizeT height = static_cast(texelSize.y()); + if (height > std::numeric_limits::max() / width || + depth > std::numeric_limits::max() / width / height) return false; + const SizeT pixelCount = width * height * depth; + if (pixelCount > std::numeric_limits::max() / (formatInfo.componentByteCount * 4) || + sourceByteSize != pixelCount * formatInfo.componentByteCount * 3) return false; MOBILEGL_ASSERT(pixelCount > 0, "ExpandRgbSourceToRgba: invalid texel size (%d, %d, %d)", texelSize.x(), texelSize.y(), texelSize.z()); MOBILEGL_ASSERT(sourceByteSize == pixelCount * formatInfo.componentByteCount * 3,