From 9788576936e80607c3cdb40ca98aa6d3cc35fa50 Mon Sep 17 00:00:00 2001
From: Tim Ledbetter <timledbetter@gmail.com>
Date: Wed, 11 Oct 2023 17:57:56 +0100
Subject: [PATCH] LibVideo/VP9: Ensure color space is not set to reserved value

---
 Userland/Libraries/LibVideo/VP9/Parser.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Userland/Libraries/LibVideo/VP9/Parser.cpp b/Userland/Libraries/LibVideo/VP9/Parser.cpp
index 90292861ac..35ad1dbec7 100644
--- a/Userland/Libraries/LibVideo/VP9/Parser.cpp
+++ b/Userland/Libraries/LibVideo/VP9/Parser.cpp
@@ -330,6 +330,9 @@ DecoderErrorOr<ColorConfig> Parser::parse_color_config(BigEndianInputBitStream&
     }
 
     auto color_space = static_cast<ColorSpace>(TRY_READ(bit_stream.read_bits(3)));
+    if (color_space == ColorSpace::Reserved)
+        return DecoderError::corrupted("color_config: Color space reserved value was set"sv);
+
     VERIFY(color_space <= ColorSpace::RGB);
 
     VideoFullRangeFlag video_full_range_flag;