From 3f4b056043b9f775aeacfad2f76da8785b36deab Mon Sep 17 00:00:00 2001
From: Ashley Wulber <ashley@system76.com>
Date: Thu, 19 Mar 2026 14:23:32 -0400
Subject: [PATCH 1/4] fix: bounds check pixels

---
 wgpu/src/image/atlas.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/wgpu/src/image/atlas.rs b/wgpu/src/image/atlas.rs
index bbd71d4e7e..bed59d9baf 100644
--- a/wgpu/src/image/atlas.rs
+++ b/wgpu/src/image/atlas.rs
@@ -346,6 +346,9 @@ impl Atlas {
         let pad_h = padding.height as usize;
         let stride = PIXEL * w;
 
+        if pixels.len() < offset + stride * h {
+            return;
+        }
         // Copy image rows
         for row in 0..h {
             let src = offset + row * PIXEL * image_width as usize;

From 50dd63d421da58dd163ed331bb54796bcec3c097 Mon Sep 17 00:00:00 2001
From: Ashley Wulber <ashley@system76.com>
Date: Thu, 19 Mar 2026 16:33:28 -0400
Subject: [PATCH 2/4] fix: use image_width for bounds check

---
 wgpu/src/image/atlas.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wgpu/src/image/atlas.rs b/wgpu/src/image/atlas.rs
index bed59d9baf..633699eb89 100644
--- a/wgpu/src/image/atlas.rs
+++ b/wgpu/src/image/atlas.rs
@@ -346,7 +346,7 @@ impl Atlas {
         let pad_h = padding.height as usize;
         let stride = PIXEL * w;
 
-        if pixels.len() < offset + stride * h {
+        if pixels.len() < offset + PIXEL * image_width as usize * h {
             return;
         }
         // Copy image rows

From 51c5171c465206a550926ed425db9545acd35f0a Mon Sep 17 00:00:00 2001
From: Ashley Wulber <ashley@system76.com>
Date: Thu, 19 Mar 2026 17:22:26 -0400
Subject: [PATCH 3/4] fix: bounds check padding

---
 wgpu/src/image/atlas.rs | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/wgpu/src/image/atlas.rs b/wgpu/src/image/atlas.rs
index 633699eb89..9abe858738 100644
--- a/wgpu/src/image/atlas.rs
+++ b/wgpu/src/image/atlas.rs
@@ -346,9 +346,20 @@ impl Atlas {
         let pad_h = padding.height as usize;
         let stride = PIXEL * w;
 
+        // bounds check for source pixels to fragment
         if pixels.len() < offset + PIXEL * image_width as usize * h {
             return;
         }
+
+        // bounds check for pad_w low / high to fragment
+        if pad_w > 0
+            && (offset + stride < PIXEL
+                || offset + image_width as usize * PIXEL * h + PIXEL
+                    > pixels.len())
+        {
+            return;
+        }
+
         // Copy image rows
         for row in 0..h {
             let src = offset + row * PIXEL * image_width as usize;

From da6f666648c3a4102607fa513c4b48acdabff059 Mon Sep 17 00:00:00 2001
From: Ashley Wulber <ashley@system76.com>
Date: Thu, 19 Mar 2026 17:55:12 -0400
Subject: [PATCH 4/4] fix: off by one on bounds check

---
 wgpu/src/image/atlas.rs | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/wgpu/src/image/atlas.rs b/wgpu/src/image/atlas.rs
index 9abe858738..0432e4ebf1 100644
--- a/wgpu/src/image/atlas.rs
+++ b/wgpu/src/image/atlas.rs
@@ -354,7 +354,11 @@ impl Atlas {
         // bounds check for pad_w low / high to fragment
         if pad_w > 0
             && (offset + stride < PIXEL
-                || offset + image_width as usize * PIXEL * h + PIXEL
+                || offset
+                    + image_width as usize
+                        * PIXEL
+                        * (h.checked_sub(1).unwrap_or(0))
+                    + PIXEL
                     > pixels.len())
         {
             return;