fix(userspace): clip display rects, bounds-check session app ids and fat16 handles, reject bad fat16 geometry, session kills via process cap

crates/servers/display-server/src/tests/server.rs

@@ -1,11 +1,14 @@
-use driver_framebuffer_mock::MockFramebuffer;
 use crate::protocol::{DisplayRequest, DisplayResponse};
 use crate::server::DisplayServer;
+use driver_framebuffer_mock::MockFramebuffer;
 use server_framework::Server;
 use types::display::{Color, Dimension, ScreenCoord};
 
 fn test_server() -> DisplayServer<MockFramebuffer> {
-    DisplayServer::new(MockFramebuffer::new(Dimension::new(320), Dimension::new(240)))
+    DisplayServer::new(MockFramebuffer::new(
+        Dimension::new(320),
+        Dimension::new(240),
+    ))
 }
 
 #[test]
@@ -32,7 +35,9 @@ fn clear_resets_pixels() {
         h: Dimension::new(10),
         color: Color::from_raw(0xFF),
     });
-    server.handle(DisplayRequest::Clear { color: Color::from_raw(0) });
+    server.handle(DisplayRequest::Clear {
+        color: Color::from_raw(0),
+    });
     assert_eq!(server.framebuffer().pixel_count(), 0);
 }
 
@@ -69,8 +74,67 @@ fn draw_rect_correct_pixel_positions() {
     });
     let fb = server.framebuffer();
     assert_eq!(fb.pixel_count(), 4);
-    assert_eq!(fb.pixel_at(0), (ScreenCoord::new(5), ScreenCoord::new(10), Color::from_raw(0xAB)));
-    assert_eq!(fb.pixel_at(1), (ScreenCoord::new(6), ScreenCoord::new(10), Color::from_raw(0xAB)));
-    assert_eq!(fb.pixel_at(2), (ScreenCoord::new(5), ScreenCoord::new(11), Color::from_raw(0xAB)));
-    assert_eq!(fb.pixel_at(3), (ScreenCoord::new(6), ScreenCoord::new(11), Color::from_raw(0xAB)));
+    assert_eq!(
+        fb.pixel_at(0),
+        (
+            ScreenCoord::new(5),
+            ScreenCoord::new(10),
+            Color::from_raw(0xAB)
+        )
+    );
+    assert_eq!(
+        fb.pixel_at(1),
+        (
+            ScreenCoord::new(6),
+            ScreenCoord::new(10),
+            Color::from_raw(0xAB)
+        )
+    );
+    assert_eq!(
+        fb.pixel_at(2),
+        (
+            ScreenCoord::new(5),
+            ScreenCoord::new(11),
+            Color::from_raw(0xAB)
+        )
+    );
+    assert_eq!(
+        fb.pixel_at(3),
+        (
+            ScreenCoord::new(6),
+            ScreenCoord::new(11),
+            Color::from_raw(0xAB)
+        )
+    );
+}
+
+#[test]
+fn a_huge_rect_is_clipped_to_the_screen() {
+    let mut server = test_server();
+    let resp = server.handle(DisplayRequest::DrawRect {
+        x: ScreenCoord::new(310),
+        y: ScreenCoord::new(230),
+        w: Dimension::new(u16::MAX),
+        h: Dimension::new(u16::MAX),
+        color: Color::from_raw(0xFF),
+    });
+    assert_eq!(resp, DisplayResponse::Ok);
+    assert_eq!(server.framebuffer().pixel_count(), 10 * 10);
+    let (x, y, _) = server.framebuffer().pixel_at(99);
+    assert_eq!((x.raw(), y.raw()), (319, 239));
+}
+
+#[test]
+fn an_off_screen_rect_draws_nothing() {
+    let mut server = test_server();
+    for (x, y) in [(320, 0), (0, 240), (u16::MAX, u16::MAX)] {
+        server.handle(DisplayRequest::DrawRect {
+            x: ScreenCoord::new(x),
+            y: ScreenCoord::new(y),
+            w: Dimension::new(u16::MAX),
+            h: Dimension::new(u16::MAX),
+            color: Color::from_raw(0xFF),
+        });
+    }
+    assert_eq!(server.framebuffer().pixel_count(), 0);
 }