From 0b824ab7a659eda9c325839ec3dcae9542b08e09 Mon Sep 17 00:00:00 2001
From: Tim Ledbetter <timledbetter@gmail.com>
Date: Mon, 2 Oct 2023 19:40:23 +0100
Subject: [PATCH] LibGfx: Check bounds of color table access in TinyVGLoader

---
 Userland/Libraries/LibGfx/ImageFormats/TinyVGLoader.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Userland/Libraries/LibGfx/ImageFormats/TinyVGLoader.cpp b/Userland/Libraries/LibGfx/ImageFormats/TinyVGLoader.cpp
index d482648faf..cff49dac2a 100644
--- a/Userland/Libraries/LibGfx/ImageFormats/TinyVGLoader.cpp
+++ b/Userland/Libraries/LibGfx/ImageFormats/TinyVGLoader.cpp
@@ -205,6 +205,9 @@ public:
     {
         auto read_color = [&]() -> ErrorOr<Color> {
             auto color_index = TRY(m_stream.read_value<VarUInt>());
+            if (color_index >= m_color_table.size())
+                return Error::from_string_literal("Invalid color table index");
+
             return m_color_table[color_index];
         };
         auto read_gradient = [&]() -> ErrorOr<NonnullRefPtr<SVGGradientPaintStyle>> {