ladybird/Userland/Services/WebContent/ImageCodecPluginSerenity.cpp
Nico Weber c9b8af70bf WebContent: Prevent renderer crash on partially invalid image
If an image had a valid header and valid metadata, but decoding the
image frame data failed, the renderer used to crash.

The crash only happened in SerenityOS, because there
ImageCodecPluginSerenity returned nullptr bitmaps.  Instead, return
{} like ImageCodecPluginLadybird already does if there's a nullptr
frame.

Fixes #19141.

Loading #19141 in the browser satisfyingly also serves as a manual
test for the bug.  (No automated test since we don't run layout
tests within SerenityOS on the bots.)
2023-06-02 09:57:20 +01:00

43 lines
1.2 KiB
C++

/*
* Copyright (c) 2022, Dex♪ <dexes.ttp@gmail.com>
* Copyright (c) 2022, Andreas Kling <kling@serenityos.org>
*
* SPDX-License-Identifier: BSD-2-Clause
*/
#include "ImageCodecPluginSerenity.h"
#include <LibImageDecoderClient/Client.h>
namespace WebContent {
ImageCodecPluginSerenity::ImageCodecPluginSerenity() = default;
ImageCodecPluginSerenity::~ImageCodecPluginSerenity() = default;
Optional<Web::Platform::DecodedImage> ImageCodecPluginSerenity::decode_image(ReadonlyBytes bytes)
{
if (!m_client) {
m_client = ImageDecoderClient::Client::try_create().release_value_but_fixme_should_propagate_errors();
m_client->on_death = [&] {
m_client = nullptr;
};
}
auto result_or_empty = m_client->decode_image(bytes);
if (!result_or_empty.has_value())
return {};
auto result = result_or_empty.release_value();
Web::Platform::DecodedImage decoded_image;
decoded_image.is_animated = result.is_animated;
decoded_image.loop_count = result.loop_count;
for (auto const& frame : result.frames) {
if (!frame.bitmap)
return {};
decoded_image.frames.empend(move(frame.bitmap), frame.duration);
}
return decoded_image;
}
}