Prechádzať zdrojové kódy

LibGfx: Prevent overflow when creating CMYKBitmaps

Fixes oss-fuzz issue 66629.
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66629
Lucas CHOLLET 1 rok pred
rodič
commit
0e20d51b0e
1 zmenil súbory, kde vykonal 7 pridanie a 1 odobranie
  1. 7 1
      Userland/Libraries/LibGfx/CMYKBitmap.cpp

+ 7 - 1
Userland/Libraries/LibGfx/CMYKBitmap.cpp

@@ -4,6 +4,7 @@
  * SPDX-License-Identifier: BSD-2-Clause
  */
 
+#include <AK/Checked.h>
 #include <LibGfx/CMYKBitmap.h>
 
 namespace Gfx {
@@ -11,7 +12,12 @@ namespace Gfx {
 ErrorOr<NonnullRefPtr<CMYKBitmap>> CMYKBitmap::create_with_size(IntSize const& size)
 {
     VERIFY(size.width() >= 0 && size.height() >= 0);
-    auto data = TRY(ByteBuffer::create_uninitialized(size.width() * size.height() * sizeof(CMYK)));
+    Checked<int> final_size { size.width() };
+    final_size.mul(size.height());
+    final_size.mul(sizeof(CMYK));
+    if (final_size.has_overflow())
+        return Error::from_string_literal("Image dimensions cause an integer overflow");
+    auto data = TRY(ByteBuffer::create_uninitialized(final_size.value()));
     return adopt_ref(*new CMYKBitmap(size, move(data)));
 }