From 52a797afdb047aaab9daaefbe7fe8a6ff5c129ba Mon Sep 17 00:00:00 2001 From: Ben Wiederhake Date: Sun, 30 Aug 2020 14:18:54 +0200 Subject: [PATCH] LibGfx: Protect against over-large bitmaps --- Libraries/LibGfx/Bitmap.cpp | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/Libraries/LibGfx/Bitmap.cpp b/Libraries/LibGfx/Bitmap.cpp index cb8eb05aeb..8eceed6aaa 100644 --- a/Libraries/LibGfx/Bitmap.cpp +++ b/Libraries/LibGfx/Bitmap.cpp @@ -44,11 +44,16 @@ namespace Gfx { -static bool size_would_overflow(BitmapFormat format, const IntSize& size) +static bool size_would_overflow(BitmapFormat, const IntSize& size) { if (size.width() < 0 || size.height() < 0) return true; - return Checked::multiplication_would_overflow(size.width(), size.height(), Bitmap::bpp_for_format(format)); + // This check is a bit arbitrary, but should protect us from most shenanigans: + if (size.width() >= 32768 || size.height() >= 32768) + return true; + // This check is absolutely necessary. Note that Bitmap::Bitmap always stores + // data as RGBA32 internally, so currently we ignore the indicated format. + return Checked::multiplication_would_overflow(size.width(), size.height(), sizeof(RGBA32)); } RefPtr Bitmap::create(BitmapFormat format, const IntSize& size)