Pārlūkot izejas kodu

LibGfx: Reject ICOs with height == NumericLimits<i32>::min()

Bitmap files use negative height values to signify that the image
should be rendered top down, but if the height value equals to the
minimum value, negating it to get the actual height results in UB.
Idan Horowitz 4 gadi atpakaļ
vecāks
revīzija
7572a355fd
1 mainītis faili ar 7 papildinājumiem un 0 dzēšanām
  1. 7 0
      Userland/Libraries/LibGfx/ICOLoader.cpp

+ 7 - 0
Userland/Libraries/LibGfx/ICOLoader.cpp

@@ -210,6 +210,13 @@ static bool load_ico_bmp(ICOLoadingContext& context, ICOImageDescriptor& desc)
             printf("load_ico_bmp: width %d < 0\n", info.width);
         return false;
     }
+
+    if (info.height == NumericLimits<i32>::min()) {
+        if constexpr (ICO_DEBUG)
+            printf("load_ico_bmp: height == NumericLimits<i32>::min()\n");
+        return false;
+    }
+
     bool topdown = false;
     if (info.height < 0) {
         topdown = true;