RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 02:37:36 +00:00
Code Issues Activity Actions

LibGfx: Copy into a u32 in LZWDecoder::next_code() instead of casting

Browse source 
This results in unaligned reads sometimes, depending on the layout of
the underlying buffer. Caught by UBSAN.
This commit is contained in:
Andrew Kaster 2021-05-24 08:23:35 -06:00 • committed by Andreas Kling
parent 74da0f24f0
commit 480802805f
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
Userland/Libraries/LibGfx/GIFLoader.cpp
View file

@ -187,8 +187,9 @@ public:
const u32* addr = (const u32*)&padded_last_bytes;
m_current_code = (*addr & mask) >> current_bit_offset;
} else {
const u32* addr = (const u32*)&m_lzw_bytes.at(current_byte_index);
m_current_code = (*addr & mask) >> current_bit_offset;
u32 tmp_word;
memcpy(&tmp_word, &m_lzw_bytes.at(current_byte_index), sizeof(u32));
m_current_code = (tmp_word & mask) >> current_bit_offset;
}
if (m_current_code > m_code_table.size()) {