diff --git a/Userland/Libraries/LibGfx/ImageFormats/TGALoader.cpp b/Userland/Libraries/LibGfx/ImageFormats/TGALoader.cpp index afd825f62b..888efe7c0a 100644 --- a/Userland/Libraries/LibGfx/ImageFormats/TGALoader.cpp +++ b/Userland/Libraries/LibGfx/ImageFormats/TGALoader.cpp @@ -195,8 +195,7 @@ ErrorOr TGAImageDecoderPlugin::decode_tga_header() auto bytes_remaining = reader->data().size() - reader->index(); - // FIXME: Check for multiplication overflow! - if (m_context->header.data_type_code == TGADataType::UncompressedRGB && bytes_remaining < static_cast(m_context->header.width * m_context->header.height * (m_context->header.bits_per_pixel / 8))) + if (m_context->header.data_type_code == TGADataType::UncompressedRGB && bytes_remaining < static_cast(m_context->header.width) * m_context->header.height * (m_context->header.bits_per_pixel / 8)) return Error::from_string_literal("Not enough data to read an image with the expected size"); if (m_context->header.bits_per_pixel < 8 || m_context->header.bits_per_pixel > 32) @@ -210,8 +209,7 @@ ErrorOr TGAImageDecoderPlugin::validate_before_create(ReadonlyBytes data) if (data.size() < sizeof(TGAHeader)) return false; TGAHeader const& header = *reinterpret_cast(data.data()); - // FIXME: Check for multiplication overflow! - if (header.data_type_code == TGADataType::UncompressedRGB && data.size() < static_cast(header.width * header.height * (header.bits_per_pixel / 8))) + if (header.data_type_code == TGADataType::UncompressedRGB && data.size() < static_cast(header.width) * header.height * (header.bits_per_pixel / 8)) return false; if (header.bits_per_pixel < 8 || header.bits_per_pixel > 32) return false;