LibGfx/ILBM: Avoid buffer overrun when reading bitplane data

Author: https://github.com/tcl3
Commit: https://github.com/SerenityOS/serenity/commit/5e1017bcf1
Pull-request: https://github.com/SerenityOS/serenity/pull/21699
Reviewed-by: https://github.com/warpdesign

Userland/Libraries/LibGfx/ImageFormats/ILBMLoader.cpp

@@ -152,18 +152,22 @@ static ErrorOr<ByteBuffer> planar_to_chunky(ReadonlyBytes bitplanes, ILBMLoading
     auto chunky = TRY(ByteBuffer::create_zeroed(width * height));
 
     for (u16 y = 0; y < height; y++) {
+        size_t scanline = y * width;
         for (u8 p = 0; p < planes; p++) {
             u8 const plane_mask = 1 << p;
+            size_t offset_base = (pitch * planes * y) + (p * pitch);
+            if (offset_base + pitch > bitplanes.size() || scanline + ((pitch - 1) * 8) + 7 >= chunky.size())
+                return Error::from_string_literal("Malformed bitplane data");
+
             for (u16 i = 0; i < pitch; i++) {
-                u16 offset = (pitch * planes * y) + (p * pitch) + i;
-                u8 bit = bitplanes[offset];
+                u8 bit = bitplanes[offset_base + i];
 
                 for (u8 b = 0; b < 8; b++) {
                     u8 mask = 1 << (7 - b);
                     // get current plane
                     if (bit & mask) {
                         u16 x = (i * 8) + b;
-                        chunky[(y * width) + x] |= plane_mask;
+                        chunky[scanline + x] |= plane_mask;
                     }
                 }
             }