system/serenity
system/serenity
1
0
Fork 0
mirror of https://github.com/SerenityOS/serenity synced 2024-10-04 15:09:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

LibGfx/ILBM: Avoid buffer overruns when decompressing data

Browse source
This commit is contained in:
Tim Ledbetter 2023-10-30 18:57:10 +00:00 committed by Andreas Kling
parent ae6c39e501
commit 75731f9c50
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
Userland/Libraries/LibGfx/ImageFormats/ILBMLoader.cpp
View file

@ -191,11 +191,20 @@ static ErrorOr<ByteBuffer> uncompress_byte_run(ReadonlyBytes data, ILBMLoadingCo
auto const byte = static_cast<i8>(data[read_bytes++]);
if (byte >= -127 && byte <= -1) {
// read next byte
if (read_bytes == data.size())
return Error::from_string_literal("Malformed compressed data");
u8 next_byte = data[read_bytes++];
if (index + -byte >= plane_data.size())
return Error::from_string_literal("Malformed compressed data");
for (u16 i = 0; i < -byte + 1; ++i) {
plane_data[index++] = next_byte;
}
} else if (byte >= 0) {
if (index + byte >= plane_data_size || read_bytes + byte >= length)
return Error::from_string_literal("Malformed compressed data");
for (u16 i = 0; i < byte + 1; ++i) {
plane_data[index] = data[read_bytes];
read_bytes++;