Google Git
Sign in
chromium / chromium / src / 31f4fb9d74ee9bfe6b212b29a7510c98c6431202
commit31f4fb9d74ee9bfe6b212b29a7510c98c6431202[log] [tgz]
authorkylechar <kylechar@chromium.org>Fri Apr 11 19:57:14 2025
committerChromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com>Fri Apr 11 19:57:14 2025
tree37aee95071b3c0606c1d63bd5ebc24f11dd33c76
parent96bd628747556f5c3e7cdba2865a9940cbf6240b [diff]
Have ui::ParseCursorFile() abort on read failure

The ParseCursorFile() implementation has to read data for all the images
matching best_size in the cursor file. This data for images is laid out
sequentially. If reading bytes for an image failed because the cursor
file isn't long enough the loop would continue and try the next image.
The next image will also fail since it's trying to read the same amount
of data. Also if for some reason it didn't fail to read bytes for the
next image it would have the wrong offset anyways.

This was discovered as a fuzzer test case had cursor file that specified
228 images that were 8184x4099. The data for those images didn't exist
but the fuzzer would timeout allocating large buffers for each and then
discovering the data didn't exist in the cursor file.

On the first failure to read any data have the function just return no
images. That matches the libxcb-cursor parse_cursor_file.c
implementation the function is based on.

Bug: 407185359
Change-Id: Id335fe24907b5b2a4f6e05d1300cc1e5dc7a347c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6446828
Reviewed-by: Thomas Anderson <thomasanderson@chromium.org>
Commit-Queue: Kyle Charbonneau <kylechar@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1446042}
1 file changed
tree: 37aee95071b3c0606c1d63bd5ebc24f11dd33c76
  1. android_webview/
  2. apps/
  3. ash/
  4. base/
  5. build/
  6. build_overrides/
  7. buildtools/
  8. cc/
  9. chrome/
  10. chromecast/
  11. chromeos/
  12. codelabs/
  13. components/
  14. content/
  15. crypto/
  16. dbus/
  17. device/
  18. docs/
  19. extensions/
  20. fuchsia_web/
  21. gin/
  22. google_apis/
  23. gpu/
  24. headless/
  25. infra/
  26. ios/
  27. ipc/
  28. media/
  29. mojo/
  30. native_client_sdk/
  31. net/
  32. pdf/
  33. ppapi/
  34. printing/
  35. remoting/
  36. rlz/
  37. sandbox/
  38. services/
  39. skia/
  40. sql/
  41. storage/
  42. styleguide/
  43. testing/
  44. third_party/
  45. tools/
  46. ui/
  47. url/
  48. webkit/
  49. clank
  50. internal
  51. ios_internal
  52. native_client
  53. signing_keys
  54. v8
  55. .clang-format
  56. .clang-tidy
  57. .clangd
  58. .git-blame-ignore-revs
  59. .gitallowed
  60. .gitattributes
  61. .gitignore
  62. .gitmodules
  63. .gn
  64. .mailmap
  65. .rustfmt.toml
  66. .vpython3
  67. .yapfignore
  68. ATL_OWNERS
  69. AUTHORS
  70. BUILD.gn
  71. CODE_OF_CONDUCT.md
  72. codereview.settings
  73. CPPLINT.cfg
  74. CRYPTO_OWNERS
  75. DEPS
  76. DIR_METADATA
  77. LICENSE
  78. LICENSE.chromium_os
  79. OWNERS
  80. PRESUBMIT.py
  81. PRESUBMIT_test.py
  82. PRESUBMIT_test_mocks.py
  83. README.md
  84. WATCHLISTS
README.md

Logo Chromium

Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.

The project's web site is https://www.chromium.org.

To check out the source code locally, don't use git clone! Instead, follow the instructions on how to get the code.

Documentation in the source is rooted in docs/README.md.

Learn how to Get Around the Chromium Source Code Directory Structure.

For historical reasons, there are some small top level directories. Now the guidance is that new top level directories are for product (e.g. Chrome, Android WebView, Ash). Even if these products have multiple executables, the code should be in subdirectories of the product.

If you found a bug, please file it at https://crbug.com/new.