0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

LibGfx: Fail PGM decode if there isn't enough color data in image

Browse source 
If we have less pixel color data than we need to fill the image, just
fail the decode.

Found by oss-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29127
This commit is contained in:
Andreas Kling 2021-01-05 15:14:29 +01:00
parent 5e95d62ffe
commit 7d5a369ac9
Notes: sideshowbarker 2024-07-19 00:05:49 +09:00
2 changed files with 21 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
Libraries/LibGfx/PGMLoader.cpp
View file

@ -67,6 +67,21 @@ struct PGMLoadingContext {
RefPtr<Gfx::Bitmap> bitmap;
};
static void set_adjusted_pixels(PGMLoadingContext& context, const AK::Vector<Gfx::Color>& color_data)
{
size_t index = 0;
for (size_t y = 0; y < context.height; ++y) {
for (size_t x = 0; x < context.width; ++x) {
Color color = color_data.at(index);
if (context.max_val < 255) {
color = adjust_color(context.max_val, color);
}
context.bitmap->set_pixel(x, y, color);
++index;
}
}
}
static bool read_image_data(PGMLoadingContext& context, Streamer& streamer)
{
Vector<Gfx::Color> color_data;
@ -90,10 +105,15 @@ static bool read_image_data(PGMLoadingContext& context, Streamer& streamer)
}
}
if (!create_bitmap(context)) {
size_t context_size = (u32)context.width * (u32)context.height;
if (context_size != color_data.size()) {
dbgln("Not enough color data in image.");
return false;
}
if (!create_bitmap(context))
return false;
set_adjusted_pixels(context, color_data);
context.state = PGMLoadingContext::State::Bitmap;

16
Libraries/LibGfx/PortableImageLoaderCommon.h
View file

@ -216,22 +216,6 @@ static bool create_bitmap(TContext& context)
return true;
}
template<typename TContext>
static void set_adjusted_pixels(TContext& context, const AK::Vector<Gfx::Color>& color_data)
{
size_t index = 0;
for (size_t y = 0; y < context.height; ++y) {
for (size_t x = 0; x < context.width; ++x) {
Color color = color_data.at(index);
if (context.max_val < 255) {
color = adjust_color(context.max_val, color);
}
context.bitmap->set_pixel(x, y, color);
index++;
}
}
}
template<typename TContext>
static void set_pixels(TContext& context, const AK::Vector<Gfx::Color>& color_data)
{