RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 20:57:35 +00:00
Code Issues Activity Actions

LibGfx: add bounds checking before set_pixel call in GIF decoder

Browse source 
This fixes a crash when a GIF frame extends beyond the limits of the
logical screen, causing writes past the end of the frame buffer
This commit is contained in:
Peter Nelson 2020-11-01 15:26:26 +00:00 • committed by Andreas Kling
parent a28f29c82c
commit 5567408bab
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Libraries/LibGfx/GIFLoader.cpp
View file

@ -355,7 +355,7 @@ static bool decode_frame(GIFLoadingContext& context, size_t frame_index)
int x = pixel_index % image.width + image.x; int x = pixel_index % image.width + image.x;
int y = row + image.y; int y = row + image.y;
if (!image.transparent || color != image.transparency_index) { if (context.frame_buffer->rect().contains(x, y) && (!image.transparent || color != image.transparency_index)) {
context.frame_buffer->set_pixel(x, y, c); context.frame_buffer->set_pixel(x, y, c);
} }