RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 03:27:45 +00:00
Code Issues Activity Actions

LibGfx: Prevent reading OOB in TGA header decode

Browse source
This commit is contained in:
Jelle Raaijmakers 2023-01-15 18:35:56 +01:00
parent 68fa8525bf
commit 5ed53b3474
1 changed files with 4 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Userland/Libraries/LibGfx/TGALoader.cpp
View file

@ -151,8 +151,6 @@ private:
struct TGALoadingContext { struct TGALoadingContext {
TGAHeader header; TGAHeader header;
ReadonlyBytes bytes;
size_t file_size;
OwnPtr<TGAReader> reader = { nullptr }; OwnPtr<TGAReader> reader = { nullptr };
RefPtr<Gfx::Bitmap> bitmap; RefPtr<Gfx::Bitmap> bitmap;
}; };
@ -160,9 +158,7 @@ struct TGALoadingContext {
TGAImageDecoderPlugin::TGAImageDecoderPlugin(u8 const* file_data, size_t file_size) TGAImageDecoderPlugin::TGAImageDecoderPlugin(u8 const* file_data, size_t file_size)
{ {
m_context = make<TGALoadingContext>(); m_context = make<TGALoadingContext>();
m_context->bytes = ReadonlyBytes(file_data, file_size); m_context->reader = make<TGAReader>(ReadonlyBytes { file_data, file_size });
m_context->file_size = move(file_size);
m_context->reader = make<TGAReader>(m_context->bytes);
} }
TGAImageDecoderPlugin::~TGAImageDecoderPlugin() = default; TGAImageDecoderPlugin::~TGAImageDecoderPlugin() = default;
@ -188,6 +184,9 @@ bool TGAImageDecoderPlugin::set_nonvolatile(bool& was_purged)
bool TGAImageDecoderPlugin::decode_tga_header() bool TGAImageDecoderPlugin::decode_tga_header()
{ {
auto& reader = m_context->reader; auto& reader = m_context->reader;
if (reader->data().size() < sizeof(TGAHeader))
return false;
m_context->header = TGAHeader(); m_context->header = TGAHeader();
m_context->header.id_length = reader->read_u8(); m_context->header.id_length = reader->read_u8();
m_context->header.color_map_type = reader->read_u8(); m_context->header.color_map_type = reader->read_u8();