@next2d/builder 0.1.11 → 0.3.0

package/templates/electron/index.js

@@ -0,0 +1,119 @@
+const { app, BrowserWindow, Menu, net, protocol, screen, session, ipcMain } = require("electron");
+const path = require("node:path");
+const fs = require("node:fs");
+const { pathToFileURL } = require("node:url");
+const { resolveAssetPath, CSP } = require("./local-assets.cjs");
+const config = require("./runtime-config.json");
+const { NativeBridge, isTrustedSender } = require("./native-bridge.cjs");
+let nativeBridge;
+const closeNativeBridge = () => nativeBridge?.close();
+process.on("exit", closeNativeBridge);
+app.on("before-quit", closeNativeBridge);
+// Keep saves in a stable user directory even if the visible game name changes.
+app.setName(config.appName);
+const userDataOverride = app.commandLine.getSwitchValue("user-data-dir");
+app.setPath("userData", userDataOverride ? path.resolve(userDataOverride) : path.join(app.getPath("appData"), config.appId));
+const assetRoot = app.isPackaged
+    ? path.join(process.resourcesPath, "resources")
+    : path.join(__dirname, "resources");
+
+// A fixed secure origin supports fetch, module scripts, workers and localStorage.
+protocol.registerSchemesAsPrivileged([{
+    scheme: "next2d",
+    privileges: { standard: true, secure: true, supportFetchAPI: true, corsEnabled: true, stream: true }
+}]);
+
+const startURL = "next2d://game/index.html";
+let mainWindow;
+const createWindow = async () => {
+    const { width, height } = screen.getPrimaryDisplay().workAreaSize;
+    mainWindow = new BrowserWindow({
+        width: Math.min(config.window.width, width),
+        height: Math.min(config.window.height, height),
+        title: config.appName,
+        fullscreen: config.window.fullscreen,
+        ...(config.icon ? { icon: path.join(assetRoot, config.icon) } : {}),
+        useContentSize: true,
+        backgroundColor: "#000000",
+        autoHideMenuBar: true,
+        show: false,
+        webPreferences: {
+            nodeIntegration: false, contextIsolation: true, sandbox: true,
+            ...(config.nativeBridge ? { preload: path.join(__dirname, "preload.cjs"),
+                backgroundThrottling: config.nativeBridge.backgroundThrottling ?? false } : {})
+        }
+    });
+    mainWindow.webContents.setWindowOpenHandler(() => ({ action: "deny" }));
+    mainWindow.webContents.on("will-navigate", (event, url) => {
+        if (!resolveAssetPath(assetRoot, url)) {
+            event.preventDefault();
+        }
+    });
+    mainWindow.webContents.on("before-input-event", (event, input) => {
+        if (input.type !== "keyDown") {
+            return;
+        }
+        if (input.key === "F11" || (input.alt && input.key === "Enter")) {
+            mainWindow.setFullScreen(!mainWindow.isFullScreen());
+            event.preventDefault();
+        } else if (input.key === "Escape" && mainWindow.isFullScreen()) {
+            mainWindow.setFullScreen(false);
+            event.preventDefault();
+        }
+    });
+    mainWindow.webContents.on("render-process-gone", (_event, details) => {
+        console.error("Renderer exited:", details.reason);
+        closeNativeBridge();
+        app.exit(1);
+    });
+    mainWindow.once("ready-to-show", () => mainWindow.show());
+    await mainWindow.loadURL(startURL);
+};
+
+app.whenReady().then(async () => {
+    Menu.setApplicationMenu(process.platform === "darwin" ? Menu.buildFromTemplate([
+        { role: "appMenu" }, { role: "editMenu" }, { role: "windowMenu" }
+    ]) : null);
+    session.defaultSession.setPermissionRequestHandler((_contents, permission, callback) => {
+        callback(permission === "fullscreen");
+    });
+    session.defaultSession.setPermissionCheckHandler((_contents, permission) => permission === "fullscreen");
+    protocol.handle("next2d", async (request) => {
+        let asset = resolveAssetPath(assetRoot, request.url);
+        if (!asset || request.method !== "GET") {
+            return new Response("Not found", { status: 404 });
+        }
+        // Framework SPA routes use history.pushState (e.g. /home); reload the entry.
+        if (!path.extname(asset) && !fs.existsSync(asset)) {
+            asset = path.join(assetRoot, "index.html");
+        }
+        try {
+            const response = await net.fetch(pathToFileURL(asset).href);
+            const headers = new Headers(response.headers);
+            headers.set("Content-Security-Policy", CSP);
+            return new Response(response.body, { status: response.status, headers });
+        } catch {
+            return new Response("Not found", { status: 404 });
+        }
+    });
+    if (config.nativeBridge) {
+        ipcMain.handle("next2d:native:request", (event, method, params) => {
+            if (!isTrustedSender(event, mainWindow)) throw new Error("Native bridge access denied");
+            if (!config.nativeBridge.methods.includes(method)) throw new Error("Native method not allowed");
+            if (!nativeBridge) {
+                const nativeRoot = path.join(app.isPackaged ? process.resourcesPath : __dirname, "native");
+                nativeBridge = new NativeBridge(path.join(nativeRoot, config.nativeBridge.executable), config.nativeBridge.methods, (message) => {
+                    if (mainWindow && !mainWindow.isDestroyed()) mainWindow.webContents.send("next2d:native:event", message);
+                }, { cwd: nativeRoot });
+            }
+            return nativeBridge.request(method, params);
+        });
+    }
+    await createWindow();
+}).catch((error) => {
+    console.error(error);
+    app.exit(1);
+});
+
+// Closing the game must stop Steam's "Running" status, including on macOS.
+app.on("window-all-closed", () => app.quit());

package/templates/electron/local-assets.cjs

@@ -0,0 +1,24 @@
+const path = require("node:path");
+
+const CSP = "default-src 'self' data: blob:; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self' blob: data:; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'none'";
+const resolveAssetPath = (root, requestURL) => {
+    try {
+        const url = new URL(requestURL);
+        if (url.protocol !== "next2d:" || url.host !== "game" || url.username || url.password) {
+            return null;
+        }
+        const name = decodeURIComponent(url.pathname);
+        if (name.includes("\0") || name.includes("\\")) {
+            return null;
+        }
+        const file = path.resolve(root, `.${name === "/" ? "/index.html" : name}`);
+        const relative = path.relative(root, file);
+        if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+            return null;
+        }
+        return file;
+    } catch {
+        return null;
+    }
+};
+module.exports = { CSP, resolveAssetPath };

package/templates/electron/native-bridge.cjs

@@ -0,0 +1,98 @@
+const { spawn } = require("node:child_process");
+const { StringDecoder } = require("node:string_decoder");
+const MAX_BYTES = 256 * 1024;
+
+class NativeBridge {
+    constructor(executable, methods, onEvent, options = {}) {
+        this.methods = new Set(methods);
+        this.pending = new Map();
+        this.sequence = 0;
+        this.failure = null;
+        this.timeout = options.timeout ?? 15000;
+        this.onEvent = onEvent;
+        this.child = spawn(executable, options.args ?? [], {
+            cwd: options.cwd, shell: false, windowsHide: true, stdio: ["pipe", "pipe", "pipe"]
+        });
+        const decoder = new StringDecoder("utf8");
+        let buffer = "";
+        this.child.stdout.on("data", (chunk) => {
+            if (this.failure) return;
+            buffer += decoder.write(chunk);
+            let end;
+            while ((end = buffer.indexOf("\n")) >= 0) {
+                const line = buffer.slice(0, end);
+                buffer = buffer.slice(end + 1);
+                if (Buffer.byteLength(line) > MAX_BYTES) return this.fail("Native message too large");
+                try {
+                    const message = JSON.parse(line);
+                    if (!message || typeof message !== "object") throw new Error("Invalid message");
+                    if (typeof message.event === "string" && message.event.length <= 64 && message.event !== "bridge.closed") {
+                        this.onEvent({ event: message.event, data: message.data ?? null });
+                    } else if (Number.isSafeInteger(message.id)) {
+                        const pending = this.pending.get(message.id);
+                        if (!pending) continue;
+                        clearTimeout(pending.timer);
+                        this.pending.delete(message.id);
+                        if (typeof message.error === "string") pending.reject(new Error(message.error));
+                        else pending.resolve(message.result ?? null);
+                    } else throw new Error("Invalid message");
+                } catch {
+                    return this.fail("Invalid native protocol");
+                }
+            }
+            if (Buffer.byteLength(buffer) > MAX_BYTES) this.fail("Native message too large");
+        });
+        // Drain diagnostics without sending credentials or SDK logs to the renderer.
+        this.child.stderr.resume();
+        this.child.stdin.on("error", () => this.fail("Native input closed"));
+        this.child.once("error", () => this.fail("Native process could not start"));
+        this.child.once("exit", () => this.fail("Native process exited"));
+    }
+
+    async request(method, params) {
+        if (this.failure) throw new Error(this.failure);
+        if (!this.methods.has(method)) throw new Error("Native method not allowed");
+        if (this.pending.size >= 128 || this.child.stdin.writableLength > MAX_BYTES) throw new Error("Native bridge busy");
+        const id = ++this.sequence;
+        const line = JSON.stringify({ id, method, params: params ?? null }) + "\n";
+        if (Buffer.byteLength(line) > MAX_BYTES) throw new Error("Native request too large");
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error("Native request timed out"));
+            }, this.timeout);
+            this.pending.set(id, { resolve, reject, timer });
+            this.child.stdin.write(line);
+        });
+    }
+
+    fail(reason, graceful = false) {
+        if (this.failure) return;
+        this.failure = reason;
+        for (const pending of this.pending.values()) {
+            clearTimeout(pending.timer);
+            pending.reject(new Error(reason));
+        }
+        this.pending.clear();
+        if (graceful) {
+            this.child.stdin.end();
+            const timer = setTimeout(() => this.child.kill("SIGKILL"), 4000);
+            timer.unref();
+            this.child.once("exit", () => clearTimeout(timer));
+        } else this.child.kill("SIGKILL");
+        this.onEvent({ event: "bridge.closed", data: { reason } });
+    }
+
+    close() { this.fail("Native bridge closed", true); }
+}
+
+const isTrustedSender = (event, window) => {
+    if (!window || window.isDestroyed() || event.sender !== window.webContents
+        || event.senderFrame !== window.webContents.mainFrame) return false;
+    try {
+        const url = new URL(event.senderFrame.url);
+        return url.protocol === "next2d:" && url.host === "game" && !url.username && !url.password;
+    } catch { return false; }
+};
+
+module.exports = { NativeBridge, isTrustedSender };

package/templates/electron/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "next2d-game",
+  "version": "1.0.0",
+  "description": "Next2D desktop game",
+  "private": true,
+  "type": "commonjs",
+  "main": "index.js",
+  "devDependencies": {
+    "electron": "44.4.3"
+  }
+}

package/templates/electron/preload.cjs

@@ -0,0 +1,11 @@
+const { contextBridge, ipcRenderer } = require("electron");
+
+contextBridge.exposeInMainWorld("next2dNative", {
+    request: (method, params) => ipcRenderer.invoke("next2d:native:request", method, params),
+    onEvent: (listener) => {
+        if (typeof listener !== "function") throw new TypeError("Expected event listener");
+        const handler = (_event, message) => listener(message);
+        ipcRenderer.on("next2d:native:event", handler);
+        return () => ipcRenderer.removeListener("next2d:native:event", handler);
+    }
+});

package/templates/xbox/src/platform/StbTextRasterizer.cpp

@@ -192,16 +192,18 @@ bool ComputeLayout(const std::string& css_font, const std::wstring& text, Layout
     stbtt_GetFontVMetrics(&lo.font->info, &lo.ascent, &lo.descent, &line_gap);
     lo.cps = ToCodepoints(text);
 
+    // Keep layout arithmetic in double; stb's bitmap API still takes float.
+    const double scale = lo.scale;
     double x = 0;
     for (size_t i = 0; i < lo.cps.size(); ++i) {
         int advance = 0, lsb = 0;
         stbtt_GetCodepointHMetrics(&lo.font->info, static_cast<int>(lo.cps[i]), &advance, &lsb);
-        x += advance * lo.scale;
+        x += advance * scale;
         if (i + 1 < lo.cps.size()) {
             x += stbtt_GetCodepointKernAdvance(
                      &lo.font->info,
                      static_cast<int>(lo.cps[i]),
-                     static_cast<int>(lo.cps[i + 1])) * lo.scale;
+                     static_cast<int>(lo.cps[i + 1])) * scale;
         }
     }
     lo.width = x;
@@ -239,9 +241,10 @@ bool MeasureText(const std::string& css_font, const std::wstring& text,
     if (!ComputeLayout(css_font, text, lo)) {
         return false;
     }
+    const double scale = lo.scale;
     out.width   = lo.width;
-    out.ascent  = lo.ascent * lo.scale;
-    out.descent = -lo.descent * lo.scale;   // stbtt の descent は負値
+    out.ascent  = lo.ascent * scale;
+    out.descent = -static_cast<double>(lo.descent) * scale;   // stbtt の descent は負値
     return true;
 }
 
@@ -256,8 +259,9 @@ bool RasterizeText(const std::string& css_font, const std::wstring& text,
         return false;
     }
 
-    const double ascent_px  = lo.ascent * lo.scale;
-    const double descent_px = -lo.descent * lo.scale;
+    const double scale = lo.scale;
+    const double ascent_px  = lo.ascent * scale;
+    const double descent_px = -static_cast<double>(lo.descent) * scale;
     const int width  = std::max(1, static_cast<int>(std::ceil(lo.width)) + 2);
     const int height = std::max(1, static_cast<int>(std::ceil(ascent_px + descent_px)) + 2);
     const int baseline = static_cast<int>(std::ceil(ascent_px)) + 1;
@@ -272,7 +276,7 @@ bool RasterizeText(const std::string& css_font, const std::wstring& text,
 
         int x0 = 0, y0 = 0, x1 = 0, y1 = 0;
         const float shift_x =
-            static_cast<float>(pen_x + lsb * lo.scale - std::floor(pen_x + lsb * lo.scale));
+            static_cast<float>(pen_x + lsb * scale - std::floor(pen_x + lsb * scale));
         stbtt_GetCodepointBitmapBoxSubpixel(
             &lo.font->info, cp, lo.scale, lo.scale, shift_x, 0, &x0, &y0, &x1, &y1);
 
@@ -284,7 +288,7 @@ bool RasterizeText(const std::string& css_font, const std::wstring& text,
                 &lo.font->info, glyph.data(), gw, gh, gw,
                 lo.scale, lo.scale, shift_x, 0, cp);
 
-            const int dst_x = static_cast<int>(std::floor(pen_x + lsb * lo.scale));
+            const int dst_x = static_cast<int>(std::floor(pen_x + lsb * scale));
             const int dst_y = baseline + y0;
             for (int yy = 0; yy < gh; ++yy) {
                 const int py = dst_y + yy;
@@ -298,10 +302,10 @@ bool RasterizeText(const std::string& css_font, const std::wstring& text,
             }
         }
 
-        pen_x += advance * lo.scale;
+        pen_x += advance * scale;
         if (i + 1 < lo.cps.size()) {
             pen_x += stbtt_GetCodepointKernAdvance(
-                         &lo.font->info, cp, static_cast<int>(lo.cps[i + 1])) * lo.scale;
+                         &lo.font->info, cp, static_cast<int>(lo.cps[i + 1])) * scale;
         }
     }
 

package/templates/xbox/tests/check_local.sh

@@ -2,7 +2,8 @@
 # macOS / Linux で Windows 実機なしに実行できる検証をまとめて回す。
 #   1. RasterCore 単体テスト (実行)
 #   2. RasterCore 単体テスト (ASan/UBSan)
-#   3. V8 依存ソースの構文チェック (実 V8 ヘッダに対して。Windows API 非依存の12ファイル)
+#   3. stb 境界値・デコード回帰テスト (通常 + ASan/UBSan)
+#   4. V8 依存ソースの構文チェック (実 V8 ヘッダに対して)
 #
 # 使い方:
 #   tests/check_local.sh [V8_INCLUDE_DIR]
@@ -13,16 +14,23 @@ cd "$(dirname "$0")/.."
 V8_TAG="13.7.152.19"
 V8INC="${1:-}"
 
-echo "== 1/3 RasterCore unit tests =="
+echo "== 1/4 RasterCore unit tests =="
 c++ -std=c++17 -Wall -Wextra -O1 -o /tmp/next2d_raster_test tests/raster_test.cpp
 /tmp/next2d_raster_test
 
-echo "== 2/3 RasterCore unit tests (ASan/UBSan) =="
+echo "== 2/4 RasterCore unit tests (ASan/UBSan) =="
 c++ -std=c++17 -g -fsanitize=address,undefined -fno-omit-frame-pointer \
     -o /tmp/next2d_raster_test_asan tests/raster_test.cpp
 /tmp/next2d_raster_test_asan
 
-echo "== 3/3 V8-dependent sources syntax check (V8 ${V8_TAG}) =="
+echo "== 3/4 stb safety regression tests =="
+c++ -std=c++17 -O1 -o /tmp/next2d_stb_safety_test tests/stb_safety_test.cpp
+/tmp/next2d_stb_safety_test
+c++ -std=c++17 -g -fsanitize=address,undefined -fno-omit-frame-pointer \
+    -o /tmp/next2d_stb_safety_test_asan tests/stb_safety_test.cpp
+/tmp/next2d_stb_safety_test_asan
+
+echo "== 4/4 V8-dependent sources syntax check (V8 ${V8_TAG}) =="
 if [ -z "${V8INC}" ]; then
     if [ ! -d ".v8_headers/include" ]; then
         git clone --depth 1 --branch "${V8_TAG}" --filter=blob:none --sparse \

package/templates/xbox/tests/stb_safety_test.cpp

@@ -0,0 +1,126 @@
+// Regression tests for local stb patches. No Windows SDK, V8 or external assets.
+#include <climits>
+#include <cstdio>
+#include <cstdlib>
+#include <vector>
+
+// Record allocation attempts without allocating huge buffers in boundary tests.
+static size_t last_allocation = 0;
+static void* TestMalloc(size_t size)
+{
+    last_allocation = size;
+    return size > 64 * 1024 * 1024 ? nullptr : std::malloc(size);
+}
+static void* TestRealloc(void* data, size_t size)
+{
+    last_allocation = size;
+    return size > 64 * 1024 * 1024 ? nullptr : std::realloc(data, size);
+}
+
+#define STBI_MALLOC TestMalloc
+#define STBI_REALLOC TestRealloc
+#define STBI_FREE std::free
+#define STBI_NO_STDIO
+#define STB_IMAGE_IMPLEMENTATION
+#include "../third_party/stb_image.h"
+
+#define STB_VORBIS_NO_STDIO
+#define STB_VORBIS_NO_PUSHDATA_API
+#include "../third_party/stb_vorbis.c"
+
+static int failures = 0;
+static int checks = 0;
+#define EXPECT(condition) do { ++checks; if (!(condition)) { \
+    ++failures; std::printf("not ok - line %d: %s\n", __LINE__, #condition); } } while (0)
+
+static void Test16BitConversion()
+{
+    auto* pixel = static_cast<stbi__uint16*>(std::malloc(3 * sizeof(stbi__uint16)));
+    pixel[0] = 123; pixel[1] = 456; pixel[2] = 789;
+    auto* rgba = stbi__convert_format16(pixel, 3, 4, 1, 1);
+    EXPECT(rgba != nullptr);
+    if (rgba) {
+        EXPECT(rgba[0] == 123 && rgba[1] == 456 && rgba[2] == 789 && rgba[3] == 65535);
+        std::free(rgba);
+    }
+
+    // The original unsigned product wraps to zero for these dimensions.
+    // Conversion must reject the size before allocating or reading input pixels.
+    const unsigned int dimensions[][2] = {{65536, 8192}, {UINT_MAX, 1}, {1, UINT_MAX}};
+    for (const auto& size : dimensions) {
+        pixel = static_cast<stbi__uint16*>(std::malloc(3 * sizeof(stbi__uint16)));
+        last_allocation = 0;
+        rgba = stbi__convert_format16(pixel, 3, 4, size[0], size[1]);
+        EXPECT(rgba == nullptr);
+        EXPECT(last_allocation == 0);
+        std::free(rgba);
+    }
+}
+
+static void TestAnimatedGif()
+{
+    // Original fixture: 1x1, black/red palette. Frame 2 restores frame 1;
+    // transparent frame 3 must therefore show red, not read before the buffer.
+    std::vector<stbi_uc> gif = {
+        'G', 'I', 'F', '8', '9', 'a', 1, 0, 1, 0, 0x80, 0, 0,
+        0, 0, 0, 255, 0, 0
+    };
+    const stbi_uc controls[] = {4, 12, 5};
+    const stbi_uc pixels[] = {0x4c, 0x44, 0x44};
+    for (int i = 0; i < 3; ++i) {
+        gif.insert(gif.end(), {0x21, 0xf9, 4, controls[i], 1, 0, 0, 0,
+            0x2c, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2, 2, pixels[i], 1, 0});
+    }
+    gif.push_back(0x3b);
+    int* delays = nullptr;
+    int width = 0, height = 0, frames = 0, components = 0;
+    stbi_uc* rgba = stbi_load_gif_from_memory(gif.data(), static_cast<int>(gif.size()),
+        &delays, &width, &height, &frames, &components, 4);
+    EXPECT(rgba != nullptr);
+    EXPECT(width == 1 && height == 1 && frames == 3 && components == 4);
+    if (rgba && frames == 3) {
+        EXPECT(rgba[0] == 255 && rgba[1] == 0 && rgba[2] == 0 && rgba[3] == 255);
+        EXPECT(rgba[4] == 0 && rgba[5] == 0 && rgba[6] == 0 && rgba[7] == 255);
+        EXPECT(rgba[8] == 255 && rgba[9] == 0 && rgba[10] == 0 && rgba[11] == 255);
+    }
+    EXPECT(delays != nullptr);
+    if (delays && frames == 3) EXPECT(delays[0] == 10 && delays[1] == 10 && delays[2] == 10);
+    stbi_image_free(rgba);
+    stbi_image_free(delays);
+
+    // Oversized canvas is rejected before any pixel buffer is allocated.
+    gif[6] = gif[7] = gif[8] = gif[9] = 255;
+    last_allocation = 0;
+    rgba = stbi_load_gif_from_memory(gif.data(), static_cast<int>(gif.size()),
+        &delays, &width, &height, &frames, &components, 4);
+    EXPECT(rgba == nullptr);
+    EXPECT(last_allocation == 0);
+    stbi_image_free(rgba);
+    stbi_image_free(delays);
+}
+
+static void TestVorbisSeekBounds()
+{
+    unsigned char bytes[16] = {};
+    stb_vorbis decoder = {};
+    decoder.stream_start = bytes;
+    decoder.stream_end = bytes + sizeof(bytes);
+    for (unsigned int offset : {0U, 15U, 16U, 17U, UINT_MAX, 0U}) {
+        const bool valid = offset < sizeof(bytes);
+        EXPECT(set_file_offset(&decoder, offset) == static_cast<int>(valid));
+        EXPECT(decoder.eof == static_cast<int>(!valid));
+        EXPECT(decoder.stream == (valid ? bytes + offset : decoder.stream_end));
+    }
+    decoder.stream_end = decoder.stream_start;
+    EXPECT(set_file_offset(&decoder, 0) == 0);
+    EXPECT(decoder.eof == 1 && decoder.stream == decoder.stream_end);
+}
+
+int main()
+{
+    Test16BitConversion();
+    TestAnimatedGif();
+    TestVorbisSeekBounds();
+    std::printf("stb safety: %d checks, %d failures\n", checks, failures);
+    return failures ? 1 : 0;
+}

package/templates/xbox/third_party/LICENSES.md

@@ -12,3 +12,18 @@
 | dr_wav.h | https://github.com/mackron/dr_libs | public domain (Unlicense) / MIT-0 のデュアル |
 
 いずれも各ファイル末尾に原文のライセンス条文が含まれる。
+
+## ローカル修正 / Local patches
+
+同梱の stb には以下の修正を適用している。更新時は再適用の要否を確認し、
+`tests/stb_safety_test.cpp` と既存のプラットフォームテストを実行する。
+
+The vendored stb files include these local patches. When updating upstream code,
+check whether they are still needed and run `tests/stb_safety_test.cpp` and the
+existing platform tests.
+
+| ファイル / File | 修正 / Patch |
+|---|---|
+| stb_image.h | メモリサイズを乗算前に拡張し、16bit変換・GIFフレーム追加時のオーバーフローを検証。GIFの過去フレーム参照をバッファ内に修正。 / Widen operands before size multiplication, validate overflow in 16-bit conversion and GIF frame growth, and keep GIF previous-frame references inside the buffer. |
+| stb_truetype.h | ビットマップの確保・初期化サイズを `size_t` で乗算。 / Multiply bitmap allocation and initialization sizes in `size_t`. |
+| stb_vorbis.c | ポインタ加算前に入力サイズとシーク位置を比較。 / Check seek offsets against the input size before pointer arithmetic. |

package/templates/xbox/third_party/stb_image.h

@@ -1817,7 +1817,8 @@ static stbi__uint16 *stbi__convert_format16(stbi__uint16 *data, int img_n, int r
    if (req_comp == img_n) return data;
    STBI_ASSERT(req_comp >= 1 && req_comp <= 4);
 
-   good = (stbi__uint16 *) stbi__malloc(req_comp * x * y * 2);
+   good = (x > INT_MAX || y > INT_MAX) ? NULL :
+      (stbi__uint16 *) stbi__malloc_mad4(req_comp, (int) x, (int) y, 2, 0);
    if (good == NULL) {
       STBI_FREE(data);
       return (stbi__uint16 *) stbi__errpuc("outofmem", "Out of memory");
@@ -4821,7 +4822,7 @@ static int stbi__create_png_image_raw(stbi__png *a, stbi_uc *raw, stbi__uint32 r
             stbi__create_png_alpha_expand8(dest, dest, x, img_n);
       } else if (depth == 8) {
          if (img_n == out_n)
-            memcpy(dest, cur, x*img_n);
+            memcpy(dest, cur, (size_t) x*img_n);
          else
             stbi__create_png_alpha_expand8(dest, cur, x, img_n);
       } else if (depth == 16) {
@@ -6201,7 +6202,7 @@ static void *stbi__psd_load(stbi__context *s, int *x, int *y, int *comp, int req
       out = (stbi_uc *) stbi__malloc_mad3(8, w, h, 0);
       ri->bits_per_channel = 16;
    } else
-      out = (stbi_uc *) stbi__malloc(4 * w*h);
+      out = (stbi_uc *) stbi__malloc_mad3(4, w, h, 0);
 
    if (!out) return stbi__errpuc("outofmem", "Out of memory");
    pixelCount = w*h;
@@ -6524,7 +6525,7 @@ static void *stbi__pic_load(stbi__context *s,int *px,int *py,int *comp,int req_c
    // intermediate buffer is RGBA
    result = (stbi_uc *) stbi__malloc_mad3(x, y, 4, 0);
    if (!result) return stbi__errpuc("outofmem", "Out of memory");
-   memset(result, 0xff, x*y*4);
+   memset(result, 0xff, (size_t) x*y*4);
 
    if (!stbi__pic_load_core(s,x,y,comp, result)) {
       STBI_FREE(result);
@@ -6833,11 +6834,11 @@ static stbi_uc *stbi__gif_load_next(stbi__context *s, stbi__gif *g, int *comp, i
       }
 
       // background is what out is after the undoing of the previou frame;
-      memcpy( g->background, g->out, 4 * g->w * g->h );
+      memcpy( g->background, g->out, (size_t) 4 * g->w * g->h );
    }
 
    // clear my history;
-   memset( g->history, 0x00, g->w * g->h );        // pixels that were affected previous frame
+   memset( g->history, 0x00, (size_t) g->w * g->h );        // pixels that were affected previous frame
 
    for (;;) {
       int tag = stbi__get8(s);
@@ -6987,11 +6988,15 @@ static void *stbi__load_gif_main(stbi__context *s, int **delays, int *x, int *y,
          if (u) {
             *x = g.w;
             *y = g.h;
-            ++layers;
             stride = g.w * g.h * 4;
+            // Keep the frame count, byte offsets and allocator sizes representable.
+            if (layers == INT_MAX || !stbi__mul2sizes_valid(layers + 1, stride) ||
+                !stbi__mul2sizes_valid(layers + 1, sizeof(int)))
+               return stbi__load_gif_main_outofmem(&g, out, delays);
+            ++layers;
 
             if (out) {
-               void *tmp = (stbi_uc*) STBI_REALLOC_SIZED( out, out_size, layers * stride );
+               void *tmp = (stbi_uc*) STBI_REALLOC_SIZED( out, out_size, (size_t) layers * stride );
                if (!tmp)
                   return stbi__load_gif_main_outofmem(&g, out, delays);
                else {
@@ -7007,7 +7012,7 @@ static void *stbi__load_gif_main(stbi__context *s, int **delays, int *x, int *y,
                   delays_size = layers * sizeof(int);
                }
             } else {
-               out = (stbi_uc*)stbi__malloc( layers * stride );
+               out = (stbi_uc*)stbi__malloc( (size_t) layers * stride );
                if (!out)
                   return stbi__load_gif_main_outofmem(&g, out, delays);
                out_size = layers * stride;
@@ -7020,7 +7025,7 @@ static void *stbi__load_gif_main(stbi__context *s, int **delays, int *x, int *y,
             }
             memcpy( out + ((layers - 1) * stride), u, stride );
             if (layers >= 2) {
-               two_back = out - 2 * stride;
+               two_back = out + (layers - 2) * stride;
             }
 
             if (delays) {

package/templates/xbox/third_party/stb_truetype.h

@@ -3739,7 +3739,7 @@ STBTT_DEF unsigned char *stbtt_GetGlyphBitmapSubpixel(const stbtt_fontinfo *info
    if (yoff  ) *yoff   = iy0;
 
    if (gbm.w && gbm.h) {
-      gbm.pixels = (unsigned char *) STBTT_malloc(gbm.w * gbm.h, info->userdata);
+      gbm.pixels = (unsigned char *) STBTT_malloc((size_t) gbm.w * gbm.h, info->userdata);
       if (gbm.pixels) {
          gbm.stride = gbm.w;
 
@@ -3822,7 +3822,7 @@ static int stbtt_BakeFontBitmap_internal(unsigned char *data, int offset,  // fo
    f.userdata = NULL;
    if (!stbtt_InitFont(&f, data, offset))
       return -1;
-   STBTT_memset(pixels, 0, pw*ph); // background of 0 around pixels
+   STBTT_memset(pixels, 0, (size_t) pw*ph); // background of 0 around pixels
    x=y=1;
    bottom_y = 1;
 
@@ -3981,7 +3981,7 @@ STBTT_DEF int stbtt_PackBegin(stbtt_pack_context *spc, unsigned char *pixels, in
    stbrp_init_target(context, pw-padding, ph-padding, nodes, num_nodes);
 
    if (pixels)
-      STBTT_memset(pixels, 0, pw*ph); // background of 0 around pixels
+      STBTT_memset(pixels, 0, (size_t) pw*ph); // background of 0 around pixels
 
    return 1;
 }
@@ -4610,7 +4610,7 @@ STBTT_DEF unsigned char * stbtt_GetGlyphSDF(const stbtt_fontinfo *info, float sc
       float *precompute;
       stbtt_vertex *verts;
       int num_verts = stbtt_GetGlyphShape(info, glyph, &verts);
-      data = (unsigned char *) STBTT_malloc(w * h, info->userdata);
+      data = (unsigned char *) STBTT_malloc((size_t) w * h, info->userdata);
       precompute = (float *) STBTT_malloc(num_verts * sizeof(float), info->userdata);
 
       for (i=0,j=num_verts-1; i < num_verts; j=i++) {

package/templates/xbox/third_party/stb_vorbis.c

@@ -1401,7 +1401,7 @@ static int set_file_offset(stb_vorbis *f, unsigned int loc)
    #endif
    f->eof = 0;
    if (USE_MEMORY(f)) {
-      if (f->stream_start + loc >= f->stream_end || f->stream_start + loc < f->stream_start) {
+      if (loc >= (size_t) (f->stream_end - f->stream_start)) {
          f->stream = f->stream_end;
          f->eof = 1;
          return 0;