RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-25 11:45:07 +00:00
Code Issues Activity Actions

LibGfx: Fail PPM decode if there's not enough pixel data in the input

Browse source 
Fixes #3820.
This commit is contained in:
Andreas Kling 2020-11-13 11:58:00 +01:00
parent f234b8c129
commit 69518bd178
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
Libraries/LibGfx/PPMLoader.cpp
View file

@ -28,6 +28,7 @@
#include <AK/Endian.h> #include <AK/Endian.h>
#include <AK/LexicalPath.h> #include <AK/LexicalPath.h>
#include <AK/MappedFile.h> #include <AK/MappedFile.h>
#include <AK/ScopeGuard.h>
#include <AK/StringBuilder.h> #include <AK/StringBuilder.h>
#include <string.h> #include <string.h>
@ -266,6 +267,7 @@ static bool read_max_val(PPMLoadingContext& context, Streamer& streamer)
static bool read_image_data(PPMLoadingContext& context, Streamer& streamer) static bool read_image_data(PPMLoadingContext& context, Streamer& streamer)
{ {
Vector<Gfx::Color> color_data; Vector<Gfx::Color> color_data;
color_data.ensure_capacity(context.width * context.height);
if (context.type == PPMLoadingContext::P3_ASCII) { if (context.type == PPMLoadingContext::P3_ASCII) {
u16 red; u16 red;
@ -303,6 +305,9 @@ static bool read_image_data(PPMLoadingContext& context, Streamer& streamer)
} }
} }
if (context.width * context.height != color_data.size())
return false;
context.bitmap = Bitmap::create_purgeable(BitmapFormat::RGB32, { context.width, context.height }); context.bitmap = Bitmap::create_purgeable(BitmapFormat::RGB32, { context.width, context.height });
size_t index = 0; size_t index = 0;
@ -322,6 +327,10 @@ static bool decode_ppm(PPMLoadingContext& context)
if (context.state >= PPMLoadingContext::State::Decoded) if (context.state >= PPMLoadingContext::State::Decoded)
return true; return true;
auto error_guard = ArmedScopeGuard([&] {
context.state = PPMLoadingContext::State::Error;
});
Streamer streamer(context.data, context.data_size); Streamer streamer(context.data, context.data_size);
if (!read_magic_number(context, streamer)) if (!read_magic_number(context, streamer))
@ -351,6 +360,7 @@ static bool decode_ppm(PPMLoadingContext& context)
if (!read_image_data(context, streamer)) if (!read_image_data(context, streamer))
return false; return false;
error_guard.disarm();
context.state = PPMLoadingContext::State::Decoded; context.state = PPMLoadingContext::State::Decoded;
return true; return true;
} }