From efc033eaace392ffaf667f5ef94d5194a9818898 Mon Sep 17 00:00:00 2001
From: Pierre Le Fevre <hello@pierrelf.com>
Date: Sat, 28 Mar 2026 09:08:21 +0100
Subject: [PATCH] Validate data slice length before Metal texture upload

Prevents potential out-of-bounds read by checking that the data slice
is at least bytes_per_row * height before passing it to Metal's
replaceRegion:withBytes:bytesPerRow: API.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 crates/platform/src/metal.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/crates/platform/src/metal.rs b/crates/platform/src/metal.rs
index 59deaf5..436f07a 100644
--- a/crates/platform/src/metal.rs
+++ b/crates/platform/src/metal.rs
@@ -494,6 +494,11 @@ impl Device {
             return None;
         }
 
+        let required = bytes_per_row as usize * height as usize;
+        if data.len() < required {
+            return None;
+        }
+
         let cls = class!("MTLTextureDescriptor")?;
         let desc: *mut c_void = msg_send![
             cls.as_ptr(),
-- 
2.51.2