RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 18:28:12 +00:00
Code Issues Activity Actions

LibGfx/TIFF: Reject images with a null value in tile's dimensions

Browse source 
Fixes oss-fuzz issue 66844.
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66844&sort=-opened&q=proj%3Aserenity%20TIFF&can=1
This commit is contained in:
Lucas CHOLLET 2024-03-06 21:47:29 -05:00 • committed by Tim Flynn
parent 3a39939995
commit 40cf205c81
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Userland/Libraries/LibGfx/ImageFormats/TIFFLoader.cpp
View file

@ -63,11 +63,14 @@ public:
return {};
}
ErrorOr<void> ensure_conditional_tags_are_present() const
ErrorOr<void> ensure_conditional_tags_are_correct() const
{
if (m_metadata.photometric_interpretation() == PhotometricInterpretation::RGBPalette && !m_metadata.color_map().has_value())
return Error::from_string_literal("TIFFImageDecoderPlugin: RGBPalette image doesn't contain a color map");
if (m_metadata.tile_width() == 0u || m_metadata.tile_length() == 0u)
return Error::from_string_literal("TIFFImageDecoderPlugin: Null value in tile's dimensions");
return {};
}
@ -123,7 +126,7 @@ public:
{
TRY(ensure_baseline_tags_are_present(m_metadata));
TRY(ensure_baseline_tags_are_correct());
TRY(ensure_conditional_tags_are_present());
TRY(ensure_conditional_tags_are_correct());
cache_values();
auto maybe_error = decode_frame_impl();