LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-10-26 23:11:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

LibGfx: Prevent reading OOB in TGA header decode

Browse Source
This commit is contained in:
Jelle Raaijmakers 2023-01-15 18:35:56 +01:00
parent 68fa8525bf
commit 5ed53b3474
Notes: sideshowbarker 2024-07-17 01:38:43 +09:00 
Author: https://github.com/gmta
Commit: https://github.com/SerenityOS/serenity/commit/5ed53b3474
Pull-request: https://github.com/SerenityOS/serenity/pull/17033
Reviewed-by: https://github.com/awesomekling ✅
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
Userland/Libraries/LibGfx/TGALoader.cpp
View File

@ -151,8 +151,6 @@ private:
struct TGALoadingContext {
TGAHeader header;
ReadonlyBytes bytes;
size_t file_size;
OwnPtr<TGAReader> reader = { nullptr };
RefPtr<Gfx::Bitmap> bitmap;
};
@ -160,9 +158,7 @@ struct TGALoadingContext {
TGAImageDecoderPlugin::TGAImageDecoderPlugin(u8 const* file_data, size_t file_size)
{
m_context = make<TGALoadingContext>();
m_context->bytes = ReadonlyBytes(file_data, file_size);
m_context->file_size = move(file_size);
m_context->reader = make<TGAReader>(m_context->bytes);
m_context->reader = make<TGAReader>(ReadonlyBytes { file_data, file_size });
}
TGAImageDecoderPlugin::~TGAImageDecoderPlugin() = default;
@ -188,6 +184,9 @@ bool TGAImageDecoderPlugin::set_nonvolatile(bool& was_purged)
bool TGAImageDecoderPlugin::decode_tga_header()
{
auto& reader = m_context->reader;
if (reader->data().size() < sizeof(TGAHeader))
return false;
m_context->header = TGAHeader();
m_context->header.id_length = reader->read_u8();
m_context->header.color_map_type = reader->read_u8();