瀏覽代碼

LibGfx/TIFF: Don't try to check non-existent values

We were previously only checking the first value, this is wrong for tags
that accept multiple values (e.g. ExtraSamples) and can lead to crashes
on malformed images containing tags with a count of 0.
Lucas CHOLLET 1 年之前
父節點
當前提交
82d40aab18
共有 1 個文件被更改,包括 13 次插入9 次删除
  1. 13 9
      Userland/Libraries/LibGfx/TIFFGenerator.py

+ 13 - 9
Userland/Libraries/LibGfx/TIFFGenerator.py

@@ -407,15 +407,19 @@ def generate_tag_handler(tag: Tag) -> str:
     check_value = ''
     if tag.associated_enum is not None:
         not_in_value_list = f"({' && '.join([f'v != {v.value}' for v in tag.associated_enum])})"
-        check_value = fR"""TRY(value[0].visit(
-            []({tiff_type_to_cpp(tag.types[0])} const& v) -> ErrorOr<void> {{
-                if ({not_in_value_list})
-                    return Error::from_string_literal("TIFFImageDecoderPlugin: Invalid value for tag {tag.name}");
-                return {{}};
-            }},
-            [&](auto const&) -> ErrorOr<void> {{
-                VERIFY_NOT_REACHED();
-            }}));
+        check_value = fR"""
+        for (u32 i = 0; i < value.size(); ++i) {{
+            TRY(value[i].visit(
+                []({tiff_type_to_cpp(tag.types[0])} const& v) -> ErrorOr<void> {{
+                    if ({not_in_value_list})
+                        return Error::from_string_literal("TIFFImageDecoderPlugin: Invalid value for tag {tag.name}");
+                    return {{}};
+                }},
+                [&](auto const&) -> ErrorOr<void> {{
+                    VERIFY_NOT_REACHED();
+                }})
+            );
+        }}
 """
 
     output = fR"""    case {tag.id}: