RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 05:37:35 +00:00
Code Issues Activity Actions

LibGfx/ILBM: Avoid buffer overruns when decompressing data

Browse source
This commit is contained in:
Tim Ledbetter 2023-10-30 18:57:10 +00:00 • committed by Andreas Kling
parent ae6c39e501
commit 75731f9c50
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Userland/Libraries/LibGfx/ImageFormats/ILBMLoader.cpp
View file

@ -191,11 +191,20 @@ static ErrorOr<ByteBuffer> uncompress_byte_run(ReadonlyBytes data, ILBMLoadingCo
auto const byte = static_cast<i8>(data[read_bytes++]); auto const byte = static_cast<i8>(data[read_bytes++]);
if (byte >= -127 && byte <= -1) { if (byte >= -127 && byte <= -1) {
// read next byte // read next byte
if (read_bytes == data.size())
return Error::from_string_literal("Malformed compressed data");
u8 next_byte = data[read_bytes++]; u8 next_byte = data[read_bytes++];
if (index + -byte >= plane_data.size())
return Error::from_string_literal("Malformed compressed data");
for (u16 i = 0; i < -byte + 1; ++i) { for (u16 i = 0; i < -byte + 1; ++i) {
plane_data[index++] = next_byte; plane_data[index++] = next_byte;
} }
} else if (byte >= 0) { } else if (byte >= 0) {
if (index + byte >= plane_data_size || read_bytes + byte >= length)
return Error::from_string_literal("Malformed compressed data");
for (u16 i = 0; i < byte + 1; ++i) { for (u16 i = 0; i < byte + 1; ++i) {
plane_data[index] = data[read_bytes]; plane_data[index] = data[read_bytes];
read_bytes++; read_bytes++;