RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-06-01 10:38:13 +00:00
Code Issues Activity Actions

LibGfx/ILBM: Avoid buffer overrun when reading header chunk

Browse source
This commit is contained in:
Tim Ledbetter 2023-10-12 20:52:19 +01:00 • committed by Andreas Kling
parent f2b7224d93
commit 9e3ee0e2b5
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Userland/Libraries/LibGfx/ImageFormats/ILBMLoader.cpp
View file

@ -300,6 +300,9 @@ static ErrorOr<void> decode_bmhd_chunk(ILBMLoadingContext& context)
if (first_chunk.type != FourCC("BMHD"))
return Error::from_string_literal("IFFImageDecoderPlugin: Invalid chunk type, expected BMHD");
if (first_chunk.data.size() < sizeof(BMHDHeader))
return Error::from_string_literal("IFFImageDecoderPlugin: Not enough data for header chunk");
context.bm_header = *bit_cast<BMHDHeader const*>(first_chunk.data.data());
context.pitch = ceil_div((u16)context.bm_header.width, (u16)16) * 2;