diff --git a/Libraries/LibGfx/PNGLoader.cpp b/Libraries/LibGfx/PNGLoader.cpp index 02a3391ebe..a03fafb1d6 100644 --- a/Libraries/LibGfx/PNGLoader.cpp +++ b/Libraries/LibGfx/PNGLoader.cpp @@ -818,6 +818,16 @@ static RefPtr load_png_impl(const u8* data, size_t data_size) return context.bitmap; } +static bool is_valid_compression_method(u8 compression_method) +{ + return compression_method == 0; +} + +static bool is_valid_filter_method(u8 filter_method) +{ + return filter_method <= 4; +} + static bool process_IHDR(ReadonlyBytes data, PNGLoadingContext& context) { if (data.size() < (int)sizeof(PNG_IHDR)) @@ -829,6 +839,16 @@ static bool process_IHDR(ReadonlyBytes data, PNGLoadingContext& context) return false; } + if (!is_valid_compression_method(ihdr.compression_method)) { + dbgln("PNG has invalid compression method {}", ihdr.compression_method); + return false; + } + + if (!is_valid_filter_method(ihdr.filter_method)) { + dbgln("PNG has invalid filter method {}", ihdr.filter_method); + return false; + } + context.width = ihdr.width; context.height = ihdr.height; context.bit_depth = ihdr.bit_depth;