1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 04:37:44 +00:00

LibGfx/TinyVG: Avoid OOM if header contains a bogus color table size

This change limits the amount of memory that is initially allocated for
the color table. This prevents an OOM condition if the file contains an
incorrect color table size.
This commit is contained in:
Tim Ledbetter 2023-10-31 18:16:27 +00:00 committed by Andreas Kling
parent 1ede4f249d
commit aa54007943
3 changed files with 22 additions and 5 deletions

View file

@ -721,6 +721,20 @@ TEST_CASE(test_everything_tvg)
}
}
TEST_CASE(test_tvg_malformed)
{
Array test_inputs = {
TEST_INPUT("tvg/bogus-color-table-size.tvg"sv)
};
for (auto test_input : test_inputs) {
auto file = MUST(Core::MappedFile::map(test_input));
auto plugin_decoder = TRY_OR_FAIL(Gfx::TinyVGImageDecoderPlugin::create(file->bytes()));
auto frame_or_error = plugin_decoder->frame(0);
EXPECT(frame_or_error.is_error());
}
}
TEST_CASE(test_jxl_modular_simple_tree_upsample2_10bits)
{
auto file = MUST(Core::MappedFile::map(TEST_INPUT("jxl/modular_simple_tree_upsample2_10bits_rct.jxl"sv)));