system/serenity
system/serenity
1
0
Fork 0
mirror of https://github.com/SerenityOS/serenity synced 2024-07-09 13:10:45 +00:00
Code Issues Projects Releases Wiki Activity

LibGfx/ILBM: Ensure CMAP chunk size matches expected value

Browse Source 
The color map should be 3 bytes per pixel and should contain
`2^nPlanes` pixels. We now return an error if the color map isn't the
size we expect.
This commit is contained in:
Tim Ledbetter 2023-10-30 16:35:40 +00:00 committed by Andreas Kling
parent 61eb754f63
commit f56ae8c0e9
3 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Tests/LibGfx/TestImageDecoder.cpp
View File

@ -154,6 +154,7 @@ TEST_CASE(test_ilbm_malformed_header)
TEST_CASE(test_ilbm_malformed_frame)
{
Array test_inputs = {
TEST_INPUT("ilbm/incorrect-cmap-size.iff"sv),
TEST_INPUT("ilbm/incorrect-uncompressed-size.iff"sv),
TEST_INPUT("ilbm/missing-body-chunk.iff"sv)
};

BIN
Tests/LibGfx/test-inputs/ilbm/incorrect-cmap-size.iff Normal file
View File

Binary file not shown.

3
Userland/Libraries/LibGfx/ImageFormats/ILBMLoader.cpp
View File

@ -298,6 +298,9 @@ static ErrorOr<void> decode_iff_chunks(ILBMLoadingContext& context)
while (!chunks.is_empty()) {
auto chunk = TRY(decode_iff_advance_chunk(chunks));
if (chunk.type == FourCC("CMAP")) {
if (chunk.data.size() != (1ul << context.bm_header.planes) * 3)
return Error::from_string_literal("Invalid CMAP chunk size");
context.color_table = TRY(decode_cmap_chunk(chunk));
} else if (chunk.type == FourCC("BODY")) {
if (context.color_table.is_empty())