From 703bd4c8a3e18dfb194017f48252d4497e753a08 Mon Sep 17 00:00:00 2001 From: Nico Weber Date: Wed, 24 May 2023 08:22:28 -0400 Subject: [PATCH] WebP/Lossy: Validate show_frame and version when reading header --- Userland/Libraries/LibGfx/ImageFormats/WebPLoaderLossy.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Userland/Libraries/LibGfx/ImageFormats/WebPLoaderLossy.cpp b/Userland/Libraries/LibGfx/ImageFormats/WebPLoaderLossy.cpp index 2c9ea96e4b..41ab59d7b8 100644 --- a/Userland/Libraries/LibGfx/ImageFormats/WebPLoaderLossy.cpp +++ b/Userland/Libraries/LibGfx/ImageFormats/WebPLoaderLossy.cpp @@ -43,7 +43,11 @@ ErrorOr decode_webp_chunk_VP8_header(ReadonlyBytes vp8_data) if (!is_key_frame) return Error::from_string_literal("WebPImageDecoderPlugin: 'VP8 ' chunk not a key frame"); - // FIXME: !show_frame does not make sense in a webp file either, probably? + if (!show_frame) + return Error::from_string_literal("WebPImageDecoderPlugin: 'VP8 ' chunk has invalid visibility for webp image"); + + if (version > 3) + return Error::from_string_literal("WebPImageDecoderPlugin: unknown version number in 'VP8 ' chunk"); u32 start_code = data[3] | (data[4] << 8) | (data[5] << 16); if (start_code != 0x2a019d) // https://www.rfc-editor.org/errata/eid7370