RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 08:08:12 +00:00
Code Issues Activity Actions

LibGfx/JBIG2: Fix size bound in scan_for_immediate_generic_region_size()

Browse source 
The memmem() call passes `data.size() - 19 - sizeof(u32)` for big_len,
(18 prefix bytes skipped, the flag byte, and the trailing u32), so the
buffer needs to be at least that large.

Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67332
This commit is contained in:
Nico Weber 2024-03-13 18:46:24 -04:00 • committed by Andrew Kaster
parent ec6e7077fe
commit 7740aeca29
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Userland/Libraries/LibGfx/ImageFormats/JBIG2Loader.cpp
View file

@ -306,8 +306,8 @@ static ErrorOr<size_t> scan_for_immediate_generic_region_size(ReadonlyBytes data
// Thus, those sequences cannot occur by chance in the data that is decoded to generate the contents of the generic region." // Thus, those sequences cannot occur by chance in the data that is decoded to generate the contents of the generic region."
dbgln_if(JBIG2_DEBUG, "(Unknown data length, computing it)"); dbgln_if(JBIG2_DEBUG, "(Unknown data length, computing it)");
if (data.size() < 18) if (data.size() < 19 + sizeof(u32))
return Error::from_string_literal("JBIG2ImageDecoderPlugin: Data too short to contain segment data header"); return Error::from_string_literal("JBIG2ImageDecoderPlugin: Data too short to contain segment data header and end sequence");
// Per 7.4.6.1 Generic region segment data header, this starts with the 17 bytes described in // Per 7.4.6.1 Generic region segment data header, this starts with the 17 bytes described in
// 7.4.1 Region segment information field, followed the byte described in 7.4.6.2 Generic region segment flags. // 7.4.1 Region segment information field, followed the byte described in 7.4.6.2 Generic region segment flags.