diff --git a/Userland/Libraries/LibGfx/ImageFormats/WebPLoader.cpp b/Userland/Libraries/LibGfx/ImageFormats/WebPLoader.cpp index f694ceb930..b7cff6e3d0 100644 --- a/Userland/Libraries/LibGfx/ImageFormats/WebPLoader.cpp +++ b/Userland/Libraries/LibGfx/ImageFormats/WebPLoader.cpp @@ -162,6 +162,8 @@ static ErrorOr decode_webp_header(WebPLoadingContext& context) // Readers MAY parse such files, ignoring the trailing data." if (context.data.size() - 8 < header.file_size) return context.error("WebP data too small for size in header"); + if (header.file_size < 4) // Need at least 4 bytes for 'WEBP', else we'll trim to less than the header size below. + return context.error("WebP stored file size too small for header it's stored in"); if (context.data.size() - 8 > header.file_size) { dbgln_if(WEBP_DEBUG, "WebP has {} bytes of data, but header needs only {}. Trimming.", context.data.size(), header.file_size + 8); context.data = context.data.trim(header.file_size + 8);