RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 10:27:34 +00:00
Code Issues Activity Actions

LibGfx: Check bounds of color table access in TinyVGLoader

Browse source
This commit is contained in:
Tim Ledbetter 2023-10-02 19:40:23 +01:00 • committed by Sam Atkins
parent 3c02e3ba09
commit 0b824ab7a6
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Userland/Libraries/LibGfx/ImageFormats/TinyVGLoader.cpp
View file

@ -205,6 +205,9 @@ public:
{ {
auto read_color = [&]() -> ErrorOr<Color> { auto read_color = [&]() -> ErrorOr<Color> {
auto color_index = TRY(m_stream.read_value<VarUInt>()); auto color_index = TRY(m_stream.read_value<VarUInt>());
if (color_index >= m_color_table.size())
return Error::from_string_literal("Invalid color table index");
return m_color_table[color_index]; return m_color_table[color_index];
}; };
auto read_gradient = [&]() -> ErrorOr<NonnullRefPtr<SVGGradientPaintStyle>> { auto read_gradient = [&]() -> ErrorOr<NonnullRefPtr<SVGGradientPaintStyle>> {