RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 02:17:35 +00:00
Code Issues Activity Actions

AK: Reject BitStream reads beyond EOF by default

Browse source 
The only exception to this is the lossless WebP decoder, which
legitimately relies on this behavior, even upstream.
This commit is contained in:
Tim Schumacher 2023-11-11 13:57:48 +01:00 • committed by Andreas Kling
parent cb03d3d78f
commit 197331c922
2 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Userland/Libraries/LibGfx/ImageFormats/WebPLoaderLossless.cpp
View file

@ -26,7 +26,7 @@ ErrorOr<VP8LHeader> decode_webp_chunk_VP8L_header(ReadonlyBytes vp8l_data)
return Error::from_string_literal("WebPImageDecoderPlugin: VP8L chunk too small");
FixedMemoryStream memory_stream { vp8l_data.trim(5) };
LittleEndianInputBitStream bit_stream { MaybeOwned<Stream>(memory_stream) };
LittleEndianInputBitStream bit_stream { MaybeOwned<Stream>(memory_stream), LittleEndianInputBitStream::UnsatisfiableReadBehavior::FillWithZero };
u8 signature = TRY(bit_stream.read_bits(8));
if (signature != 0x2f)
@ -931,7 +931,7 @@ ErrorOr<NonnullRefPtr<Bitmap>> ColorIndexingTransform::transform(NonnullRefPtr<B
ErrorOr<NonnullRefPtr<Bitmap>> decode_webp_chunk_VP8L_contents(VP8LHeader const& vp8l_header)
{
FixedMemoryStream memory_stream { vp8l_header.lossless_data };
LittleEndianInputBitStream bit_stream { MaybeOwned<Stream>(memory_stream) };
LittleEndianInputBitStream bit_stream { MaybeOwned<Stream>(memory_stream), LittleEndianInputBitStream::UnsatisfiableReadBehavior::FillWithZero };
// image-stream = optional-transform spatially-coded-image