diff --git a/Userland/Libraries/LibGfx/TGALoader.cpp b/Userland/Libraries/LibGfx/TGALoader.cpp index f6928d6985..067299454a 100644 --- a/Userland/Libraries/LibGfx/TGALoader.cpp +++ b/Userland/Libraries/LibGfx/TGALoader.cpp @@ -209,7 +209,8 @@ bool TGAImageDecoderPlugin::decode_tga_header() auto bytes_remaining = reader->data().size() - reader->index(); - if (m_context->header.data_type_code == TGADataType::UncompressedRGB && bytes_remaining < (m_context->header.width * m_context->header.height * (m_context->header.bits_per_pixel / 8))) + // FIXME: Check for multiplication overflow! + if (m_context->header.data_type_code == TGADataType::UncompressedRGB && bytes_remaining < static_cast(m_context->header.width * m_context->header.height * (m_context->header.bits_per_pixel / 8))) return false; if (m_context->header.bits_per_pixel < 8 || m_context->header.bits_per_pixel > 32) @@ -228,7 +229,8 @@ ErrorOr TGAImageDecoderPlugin::validate_before_create(ReadonlyBytes data) if (data.size() < sizeof(TGAHeader)) return false; TGAHeader const& header = *reinterpret_cast(data.data()); - if (header.data_type_code == TGADataType::UncompressedRGB && data.size() < (header.width * header.height * (header.bits_per_pixel / 8))) + // FIXME: Check for multiplication overflow! + if (header.data_type_code == TGADataType::UncompressedRGB && data.size() < static_cast(header.width * header.height * (header.bits_per_pixel / 8))) return false; if (header.bits_per_pixel < 8 || header.bits_per_pixel > 32) return false;