瀏覽代碼

LibGfx/TIFF: Move check on tag values in its own function

There is only one check for now, but the fuzzer has already found more
checks to add :^)
Lucas CHOLLET 1 年之前
父節點
當前提交
ba84af7c22
共有 1 個文件被更改,包括 9 次插入3 次删除
  1. 9 3
      Userland/Libraries/LibGfx/ImageFormats/TIFFLoader.cpp

+ 9 - 3
Userland/Libraries/LibGfx/ImageFormats/TIFFLoader.cpp

@@ -42,9 +42,18 @@ public:
         return {};
         return {};
     }
     }
 
 
+    ErrorOr<void> ensure_baseline_tags_correctness() const
+    {
+        if (m_metadata.strip_offsets()->size() != m_metadata.strip_byte_counts()->size())
+            return Error::from_string_literal("TIFFImageDecoderPlugin: StripsOffset and StripByteCount have different sizes");
+
+        return {};
+    }
+
     ErrorOr<void> decode_frame()
     ErrorOr<void> decode_frame()
     {
     {
         TRY(ensure_baseline_tags_presence(m_metadata));
         TRY(ensure_baseline_tags_presence(m_metadata));
+        TRY(ensure_baseline_tags_correctness());
         auto maybe_error = decode_frame_impl();
         auto maybe_error = decode_frame_impl();
 
 
         if (maybe_error.is_error()) {
         if (maybe_error.is_error()) {
@@ -195,9 +204,6 @@ private:
         auto const strips_offset = *m_metadata.strip_offsets();
         auto const strips_offset = *m_metadata.strip_offsets();
         auto const strip_byte_counts = *m_metadata.strip_byte_counts();
         auto const strip_byte_counts = *m_metadata.strip_byte_counts();
 
 
-        if (strips_offset.size() != strip_byte_counts.size())
-            return Error::from_string_literal("TIFFImageDecoderPlugin: StripsOffset and StripByteCount have different sizes, aborting...");
-
         for (u32 strip_index = 0; strip_index < strips_offset.size(); ++strip_index) {
         for (u32 strip_index = 0; strip_index < strips_offset.size(); ++strip_index) {
             TRY(m_stream->seek(strips_offset[strip_index]));
             TRY(m_stream->seek(strips_offset[strip_index]));