RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 16:37:47 +00:00
Code Issues Activity Actions

LibGfx/TinyVG: Avoid OOM if header contains a bogus color table size

Browse source 
This change limits the amount of memory that is initially allocated for
the color table. This prevents an OOM condition if the file contains an
incorrect color table size.
This commit is contained in:
Tim Ledbetter 2023-10-31 18:16:27 +00:00 • committed by Andreas Kling
parent 1ede4f249d
commit aa54007943
3 changed files with 22 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
Tests/LibGfx/TestImageDecoder.cpp
View file

@ -721,6 +721,20 @@ TEST_CASE(test_everything_tvg)
}
}
TEST_CASE(test_tvg_malformed)
{
Array test_inputs = {
TEST_INPUT("tvg/bogus-color-table-size.tvg"sv)
};
for (auto test_input : test_inputs) {
auto file = MUST(Core::MappedFile::map(test_input));
auto plugin_decoder = TRY_OR_FAIL(Gfx::TinyVGImageDecoderPlugin::create(file->bytes()));
auto frame_or_error = plugin_decoder->frame(0);
EXPECT(frame_or_error.is_error());
}
}
TEST_CASE(test_jxl_modular_simple_tree_upsample2_10bits)
{
auto file = MUST(Core::MappedFile::map(TEST_INPUT("jxl/modular_simple_tree_upsample2_10bits_rct.jxl"sv)));