Improper validation of IPC Gfx::BitmapSequence decode requests
bughas reprocrash
The repro produces a SIGSEGV:
```
decoding single-frame BitmapSequence
decoded bitmap: buffer bytes 4096, bitmap bytes 2000000, decoded size 50000x10
touching last pixel from decoded IPC size
AddressSanitizer:DEADLYSIGNAL
=================================================================
==886953==ERROR: AddressSanitizer: SEGV on unknown address 0x7f80d388547c (pc 0x55be20731d24 bp 0x7ffdb5fabac0 sp 0x7ffdb5faa820 T0)
==886953==The signal is caused by a WRITE memory access.
#0 0x55be20731d24 in main /home/user/software_ws/findings/issues/ladybird/issues/016-2026-06-09-bitmapsequence-ipc-decode-accepts-undersized-shared-bitmap-backing-store/ipc_repro.cpp:76
#1 0x7f80cde35ca7 (/lib/x86_64-linux-gnu/libc.so.6+0x29ca7) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
#2 0x7f80cde35d64 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29d64) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
#3 0x55be2072e3d0 in _start (/home/user/software_ws/findings/issues/ladybird/issues/016-2026-06-09-bitmapsequence-ipc-decode-accepts-undersized-shared-bitmap-backing-store/bitmap_sequence_ipc_repro+0x2e3d0) (BuildId: 3752afe5439a3dabc1dc2cfa22228053f1df9ab2)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/user/software_ws/findings/issues/ladybird/issues/016-2026-06-09-bitmapsequence-ipc-decode-accepts-undersized-shared-bitmap-backing-store/ipc_repro.cpp:76 in main
==886953==ABORTING
```
[ipc_repro.cpp](https://github.com/user-attachments/files/28800065/ipc_repro.cpp)
[compile_repro.sh](https://github.com/user-attachments/files/28800064/compile_repro.sh)
0 条评论