From 193d75cb5c28d6ffe901b1f537a3bd18f16b5d63 Mon Sep 17 00:00:00 2001
From: Tony Coder <407243179@qq.com>
Date: Mon, 31 Aug 2026 09:53:09 +0800
Subject: [PATCH] fix: reject invalid image resource ids

Signed-off-by: Tony Coder <407243179@qq.com>
---
 frameworks/core/image/image_loader.cpp | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/frameworks/core/image/image_loader.cpp b/frameworks/core/image/image_loader.cpp
index d9f7ec2f490..d0a1bce90a9 100644
--- a/frameworks/core/image/image_loader.cpp
+++ b/frameworks/core/image/image_loader.cpp
@@ -15,6 +15,8 @@
 
 #include "core/image/image_loader.h"
 
+#include <charconv>
+
 #include "drawing/engine_adapter/skia_adapter/skia_data.h"
 #include "utils/data.h"
 #ifdef USE_NEW_SKIA
@@ -60,6 +62,14 @@ const std::regex MEDIA_APP_RES_ID_REGEX(R"(^resource://.*/([0-9]+)\.\w+$)", std:
 const std::regex MEDIA_RES_NAME_REGEX(R"(^resource://.*/(\w+)\.\w+$)", std::regex::icase);
 constexpr uint32_t MEDIA_RESOURCE_MATCH_SIZE = 2;
 
+bool ParseResourceId(const std::string &value, uint32_t &resourceId)
+{
+    const char *begin = value.data();
+    const char *end = begin + value.size();
+    auto parsed = std::from_chars(begin, end, resourceId);
+    return parsed.ec == std::errc{} && parsed.ptr == end;
+}
+
 const std::chrono::duration<int, std::milli> TIMEOUT_DURATION(10000);
 
 #ifdef WINDOWS_PLATFORM
@@ -644,8 +654,7 @@ bool ResourceImageLoader::GetResourceId(const std::string& uri, uint32_t& resId)
                 matches[1].length(), uri.c_str());
             return false;
         }
-        resId = static_cast<uint32_t>(std::stoul(matches[1].str()));
-        return true;
+        return ParseResourceId(matches[1].str(), resId);
     }
 
     std::smatch appMatches;
@@ -656,8 +665,7 @@ bool ResourceImageLoader::GetResourceId(const std::string& uri, uint32_t& resId)
                 appMatches[1].length(), uri.c_str());
             return false;
         }
-        resId = static_cast<uint32_t>(std::stoul(appMatches[1].str()));
-        return true;
+        return ParseResourceId(appMatches[1].str(), resId);
     }
 
     return false;