From 53fb0da879c4c7b3abdf3163edbbd0394e0fc375 Mon Sep 17 00:00:00 2001
From: Florin Malita <fmalita@google.com>
Date: Fri, 12 Jun 2026 17:52:13 -0400
Subject: [PATCH] Add some pixel buffer sizing asserts to SkWuffsCodec

The frame bounds should always fit within the allocated pixel buffer.

Bug: b/513863267
Change-Id: Ie0e71187bdbbc9cc0b648fcb32c95cc00ae66184
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1264736
Commit-Queue: Florin Malita <fmalita@google.com>
Reviewed-by: Kaylee Lubick <kjlubick@google.com>
---

diff --git a/src/codec/SkWuffsCodec.cpp b/src/codec/SkWuffsCodec.cpp
index fa02e9c..6ea13ff 100644
--- a/src/codec/SkWuffsCodec.cpp
+++ b/src/codec/SkWuffsCodec.cpp
@@ -24,6 +24,7 @@
 #include "include/core/SkSize.h"
 #include "include/core/SkStream.h"
 #include "include/core/SkTypes.h"
+#include "include/private/SkAssert.h"
 #include "include/private/SkEncodedInfo.h"
 #include "include/private/SkMalloc.h"
 #include "include/private/SkTo.h"
@@ -592,6 +593,13 @@
         wuffs_base__rect_ie_u32 frame_rect = fFrameConfig.bounds();
         wuffs_base__table_u8    pixels = fPixelBuffer.plane(0);
 
+        const size_t pixels_w = pixels.width / src_bytes_per_pixel,
+                     pixels_h = pixels.height;
+        SkASSERT_RELEASE(frame_rect.min_incl_x <= pixels_w);
+        SkASSERT_RELEASE(frame_rect.min_incl_y <= pixels_h);
+        SkASSERT_RELEASE(frame_rect.max_excl_x <= pixels_w);
+        SkASSERT_RELEASE(frame_rect.max_excl_y <= pixels_h);
+
         uint8_t* ptr = pixels.ptr + (frame_rect.min_incl_y * pixels.stride) +
                        (frame_rect.min_incl_x * src_bytes_per_pixel);
         size_t len = frame_rect.width() * src_bytes_per_pixel;
@@ -712,6 +720,13 @@
     if (!dirty_rect.is_empty()) {
         wuffs_base__table_u8 pixels = fPixelBuffer.plane(0);
 
+        const size_t pixels_w = pixels.width / src_bytes_per_pixel,
+                     pixels_h = pixels.height;
+        SkASSERT_RELEASE(dirty_rect.min_incl_x <= pixels_w);
+        SkASSERT_RELEASE(dirty_rect.min_incl_y <= pixels_h);
+        SkASSERT_RELEASE(dirty_rect.max_excl_x <= pixels_w);
+        SkASSERT_RELEASE(dirty_rect.max_excl_y <= pixels_h);
+
         // The Wuffs model is that the dst buffer is the image, not the frame.
         // The expectation is that you allocate the buffer once, but re-use it
         // for the N frames, regardless of each frame's top-left co-ordinate.