浏览代码

LibGfx/TIFF: Don't try to check non-existent values

We were previously only checking the first value, this is wrong for tags
that accept multiple values (e.g. ExtraSamples) and can lead to crashes
on malformed images containing tags with a count of 0.
Lucas CHOLLET 1 年之前
父节点
当前提交
82d40aab18
共有 1 个文件被更改,包括 13 次插入9 次删除
  1. 13 9
      Userland/Libraries/LibGfx/TIFFGenerator.py

+ 13 - 9
Userland/Libraries/LibGfx/TIFFGenerator.py

@@ -407,15 +407,19 @@ def generate_tag_handler(tag: Tag) -> str:
     check_value = ''
     check_value = ''
     if tag.associated_enum is not None:
     if tag.associated_enum is not None:
         not_in_value_list = f"({' && '.join([f'v != {v.value}' for v in tag.associated_enum])})"
         not_in_value_list = f"({' && '.join([f'v != {v.value}' for v in tag.associated_enum])})"
-        check_value = fR"""TRY(value[0].visit(
-            []({tiff_type_to_cpp(tag.types[0])} const& v) -> ErrorOr<void> {{
-                if ({not_in_value_list})
-                    return Error::from_string_literal("TIFFImageDecoderPlugin: Invalid value for tag {tag.name}");
-                return {{}};
-            }},
-            [&](auto const&) -> ErrorOr<void> {{
-                VERIFY_NOT_REACHED();
-            }}));
+        check_value = fR"""
+        for (u32 i = 0; i < value.size(); ++i) {{
+            TRY(value[i].visit(
+                []({tiff_type_to_cpp(tag.types[0])} const& v) -> ErrorOr<void> {{
+                    if ({not_in_value_list})
+                        return Error::from_string_literal("TIFFImageDecoderPlugin: Invalid value for tag {tag.name}");
+                    return {{}};
+                }},
+                [&](auto const&) -> ErrorOr<void> {{
+                    VERIFY_NOT_REACHED();
+                }})
+            );
+        }}
 """
 """
 
 
     output = fR"""    case {tag.id}:
     output = fR"""    case {tag.id}: