From faef7f701b51a65598eca47a630bfef65ee07629 Mon Sep 17 00:00:00 2001 From: Tony Coder <407243179@qq.com> Date: Mon, 31 Aug 2026 09:54:57 +0800 Subject: [PATCH] fix: reject overflowing SVG RGB components Signed-off-by: Tony Coder <407243179@qq.com> --- .../svg/parse/svg_attributes_parser.cpp | 24 ++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/frameworks/core/components_ng/svg/parse/svg_attributes_parser.cpp b/frameworks/core/components_ng/svg/parse/svg_attributes_parser.cpp index 6482b327e7d..b003e26abfe 100644 --- a/frameworks/core/components_ng/svg/parse/svg_attributes_parser.cpp +++ b/frameworks/core/components_ng/svg/parse/svg_attributes_parser.cpp @@ -15,6 +15,7 @@ #include "frameworks/core/components_ng/svg/parse/svg_attributes_parser.h" +#include #include #include "core/common/container.h" @@ -372,9 +373,26 @@ bool SvgAttributesParser::CheckColorAlpha(const std::string& colorStr, Color& re matches[RGBA_MATCH_BLUE].length(), matches[RGBA_MATCH_ALPHA].length()); return false; } - auto red = static_cast(std::stoi(matches[RGBA_MATCH_RED])); - auto green = static_cast(std::stoi(matches[RGBA_MATCH_GREEN])); - auto blue = static_cast(std::stoi(matches[RGBA_MATCH_BLUE])); + auto parseRgb = [](const std::string &value, uint8_t &result) { + uint32_t parsedValue = 0; + const char *begin = value.data(); + const char *end = begin + value.size(); + auto parsed = std::from_chars(begin, end, parsedValue); + if (parsed.ec != std::errc{} || parsed.ptr != end || parsedValue > UINT8_MAX) { + return false; + } + result = static_cast(parsedValue); + return true; + }; + uint8_t red = 0; + uint8_t green = 0; + uint8_t blue = 0; + if (!parseRgb(matches[RGBA_MATCH_RED].str(), red) || + !parseRgb(matches[RGBA_MATCH_GREEN].str(), green) || + !parseRgb(matches[RGBA_MATCH_BLUE].str(), blue)) { + LOGW("CheckColorAlpha rejected, RGB component is out of range"); + return false; + } auto alpha = static_cast(std::stod(matches[RGBA_MATCH_ALPHA])); // Scale up from 0~1.0 to 255 result = Color::FromARGB(static_cast(std::min(MAX_ALPHA, alpha)) * 0xff, red, green, blue);