RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 13:48:12 +00:00
Code Issues Activity Actions

LibGfx: In webp decoder, check that each transform is used only once

Browse source
This commit is contained in:
Nico Weber 2023-04-04 20:09:13 -04:00 • committed by Linus Groh
parent ae1f7124ac
commit 2fc682c033
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Userland/Libraries/LibGfx/ImageFormats/WebPLoader.cpp
View file

@ -648,6 +648,8 @@ static ErrorOr<void> decode_webp_chunk_VP8L(WebPLoadingContext& context, Chunk c
// https://developers.google.com/speed/webp/docs/webp_lossless_bitstream_specification#72_structure_of_transforms
// optional-transform = (%b1 transform optional-transform) / %b0
// "Each transform is allowed to be used only once."
u8 seen_transforms = 0;
while (TRY(bit_stream.read_bits(1))) {
// transform = predictor-tx / color-tx / subtract-green-tx
// transform =/ color-indexing-tx
@ -669,6 +671,12 @@ static ErrorOr<void> decode_webp_chunk_VP8L(WebPLoadingContext& context, Chunk c
TransformType transform_type = static_cast<TransformType>(TRY(bit_stream.read_bits(2)));
dbgln_if(WEBP_DEBUG, "transform type {}", (int)transform_type);
// Check that each transfom is used only once.
u8 mask = 1 << (int)transform_type;
if (seen_transforms & mask)
return context.error("WebPImageDecoderPlugin: transform type used multiple times");
seen_transforms |= mask;
switch (transform_type) {
case PREDICTOR_TRANSFORM:
return context.error("WebPImageDecoderPlugin: VP8L PREDICTOR_TRANSFORM handling not yet implemented");