diff --git a/Userland/Libraries/LibGfx/ImageFormats/ILBMLoader.cpp b/Userland/Libraries/LibGfx/ImageFormats/ILBMLoader.cpp index 83ad61110a..9da98c29d2 100644 --- a/Userland/Libraries/LibGfx/ImageFormats/ILBMLoader.cpp +++ b/Userland/Libraries/LibGfx/ImageFormats/ILBMLoader.cpp @@ -191,11 +191,20 @@ static ErrorOr uncompress_byte_run(ReadonlyBytes data, ILBMLoadingCo auto const byte = static_cast(data[read_bytes++]); if (byte >= -127 && byte <= -1) { // read next byte + if (read_bytes == data.size()) + return Error::from_string_literal("Malformed compressed data"); + u8 next_byte = data[read_bytes++]; + if (index + -byte >= plane_data.size()) + return Error::from_string_literal("Malformed compressed data"); + for (u16 i = 0; i < -byte + 1; ++i) { plane_data[index++] = next_byte; } } else if (byte >= 0) { + if (index + byte >= plane_data_size || read_bytes + byte >= length) + return Error::from_string_literal("Malformed compressed data"); + for (u16 i = 0; i < byte + 1; ++i) { plane_data[index] = data[read_bytes]; read_bytes++;