Improvements

Author: Lord-Grey

CHANGELOG.md

@@ -31,7 +31,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - EffectModule - Refactor and stablising
 - EffectFileHandler: Refactor effect file management
 - EffectEngine: Added dedicated `hyperion.effect` debug logging category
-- Empty image consistency applied. An image sized 1x1 is not treated as an empty one any longer, only 0x0 is empty.
+- Empty image consistency applied. 0×0 is now the canonical empty image; 1×1 is no longer treated as empty
 
 ## [2.2.1](https://github.com/hyperion-project/hyperion.ng/releases/tag/2.2.1) - 2026-04-06
 

libsrc/effectengine/EffectFileHandler.cpp

@@ -190,15 +190,18 @@ QString EffectFileHandler::saveEffectImage(const QJsonObject& message, const QJs
 		return "";
 
 	QJsonObject args = message["args"].toObject();
-	const QString effectsDirPath = effectArray[0].toString().replace("$ROOT", _rootPath);
-	const QString effectsDirAbs = QFileInfo(effectsDirPath).absoluteFilePath();
-	const QString imageFilePath = effectsDirPath + '/' + args.value("file").toString();
-	const QFileInfo imageFileName(imageFilePath);
-	if (!imageFileName.absoluteFilePath().startsWith(effectsDirAbs + '/'))
-		return QString("Invalid image file path '%1'.").arg(args.value("file").toString());
-
-	if (!FileUtils::writeFile(imageFileName.absoluteFilePath(), QByteArray::fromBase64(message["imageData"].toString("").toUtf8()), _log))
-		return QString("Error while saving image file '%1', please check the Hyperion Log").arg(message["args"].toObject().value("file").toString());
+	const QString requestedFile = args.value("file").toString();
+	if (requestedFile.contains('/') || requestedFile.contains('\\') || requestedFile.contains(".."))
+		return QString("Invalid image file path '%1'.").arg(requestedFile);
+
+	const QDir effectsDir(effectArray[0].toString().replace("$ROOT", _rootPath));
+	const QString effectsDirAbs = QDir::cleanPath(effectsDir.absolutePath());
+	const QString imageFilePath = QDir::cleanPath(effectsDir.absoluteFilePath(requestedFile));
+	if (!imageFilePath.startsWith(effectsDirAbs + QDir::separator()))
+		return QString("Invalid image file path '%1'.").arg(requestedFile);
+
+	if (!FileUtils::writeFile(imageFilePath, QByteArray::fromBase64(message["imageData"].toString("").toUtf8()), _log))
+		return QString("Error while saving image file '%1', please check the Hyperion Log").arg(requestedFile);
 
 	args["file"] = imageFilePath;
 	effectJson["args"] = args;

libsrc/effectengine/EffectModule.cpp

@@ -1,4 +1,5 @@
 #include <cmath>
+#include <limits>
 
 #include <effectengine/Effect.h>
 #include <effectengine/EffectModule.h>
@@ -277,12 +278,26 @@ PyObject* EffectModule::wrapSetImage(PyObject* /*self*/, PyObject* args)
 	{
 		if (PyByteArray_Check(bytearray))
 		{
+			if (width <= 0 || height <= 0)
+			{
+				PyErr_SetString(PyExc_ValueError, "Image width and height must be positive");
+				return nullptr;
+			}
+
 			Py_ssize_t length = PyByteArray_Size(bytearray);
-			if (length == 3 * width * height)
+			const uint64_t pixelCount = static_cast<uint64_t>(width) * static_cast<uint64_t>(height);
+			if (pixelCount > static_cast<uint64_t>(std::numeric_limits<Py_ssize_t>::max()) / 3U)
+			{
+				PyErr_SetString(PyExc_OverflowError, "Image dimensions are too large");
+				return nullptr;
+			}
+
+			const Py_ssize_t expectedLength = static_cast<Py_ssize_t>(pixelCount * 3U);
+			if (length == expectedLength)
 			{
 				Image<ColorRgb> image(width, height);
 				const char* data = PyByteArray_AS_STRING(bytearray);
-				memcpy(image.memptr(), data, length);
+				memcpy(image.memptr(), data, static_cast<size_t>(length));
 				emit getEffect()->setInputImage(getEffect()->_priority, image, getEffect()->getRemaining(), false);
 				Py_RETURN_NONE;
 			}
@@ -906,7 +921,12 @@ PyObject* EffectModule::wrapImageDrawPie(PyObject* /*self*/, PyObject* args)
 					(uint8_t)(data[idx + 4])
 				));
 		}
+
 		painter->setBrush(gradient);
+		QPen oldPen = painter->pen();
+		painter->setPen(Qt::NoPen);
+		painter->drawPie(centerX - radius, centerY - radius, radius * 2, radius * 2, startAngle * 16, spanAngle * 16);
+		painter->setPen(oldPen);
 		Py_RETURN_NONE;
 	}
 
@@ -1185,11 +1205,10 @@ PyObject* EffectModule::wrapImageCOffset(PyObject* /*self*/, PyObject* args)
 {
 	int offsetX = 0;
 	int offsetY = 0;
-	Py_ssize_t argCount = PyTuple_Size(args);
-
-	if (argCount == 2)
+	if (!PyArg_ParseTuple(args, "ii", &offsetX, &offsetY))
 	{
-		PyArg_ParseTuple(args, "ii", &offsetX, &offsetY);
+		if (!PyErr_Occurred()) { PyErr_SetString(PyExc_TypeError, "Invalid argument count or type."); }
+		return nullptr;
 	}
 
 	getEffect()->_painter->translate(QPoint(offsetX, offsetY));