RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 11:47:45 +00:00
Code Issues Activity Actions

LibGfx: Reject PNG files with invalid filter/interlace methods

Browse source 
Might as well reject these when parsing the IHDR chunk instead of
continuing to load something invalid.
This commit is contained in:
Andreas Kling 2020-12-23 15:44:54 +01:00
parent 5f182746b6
commit 068615fe5e
1 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
Libraries/LibGfx/PNGLoader.cpp
View file

@ -818,6 +818,16 @@ static RefPtr<Gfx::Bitmap> load_png_impl(const u8* data, size_t data_size)
return context.bitmap; return context.bitmap;
} }
static bool is_valid_compression_method(u8 compression_method)
{
return compression_method == 0;
}
static bool is_valid_filter_method(u8 filter_method)
{
return filter_method <= 4;
}
static bool process_IHDR(ReadonlyBytes data, PNGLoadingContext& context) static bool process_IHDR(ReadonlyBytes data, PNGLoadingContext& context)
{ {
if (data.size() < (int)sizeof(PNG_IHDR)) if (data.size() < (int)sizeof(PNG_IHDR))
@ -829,6 +839,16 @@ static bool process_IHDR(ReadonlyBytes data, PNGLoadingContext& context)
return false; return false;
} }
if (!is_valid_compression_method(ihdr.compression_method)) {
dbgln("PNG has invalid compression method {}", ihdr.compression_method);
return false;
}
if (!is_valid_filter_method(ihdr.filter_method)) {
dbgln("PNG has invalid filter method {}", ihdr.filter_method);
return false;
}
context.width = ihdr.width; context.width = ihdr.width;
context.height = ihdr.height; context.height = ihdr.height;
context.bit_depth = ihdr.bit_depth; context.bit_depth = ihdr.bit_depth;