0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

WebContent: Prevent renderer crash on partially invalid image

Browse source 
If an image had a valid header and valid metadata, but decoding the
image frame data failed, the renderer used to crash.

The crash only happened in SerenityOS, because there
ImageCodecPluginSerenity returned nullptr bitmaps.  Instead, return
{} like ImageCodecPluginLadybird already does if there's a nullptr
frame.

Fixes #19141.

Loading #19141 in the browser satisfyingly also serves as a manual
test for the bug.  (No automated test since we don't run layout
tests within SerenityOS on the bots.)
This commit is contained in:
Nico Weber 2023-06-01 21:04:04 -04:00 • committed by Sam Atkins
parent 5617dd1c83
commit c9b8af70bf
Notes: sideshowbarker 2024-07-16 20:51:53 +09:00
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Userland/Services/WebContent/ImageCodecPluginSerenity.cpp
View file

@ -31,6 +31,8 @@ Optional<Web::Platform::DecodedImage> ImageCodecPluginSerenity::decode_image(Rea
decoded_image.is_animated = result.is_animated;
decoded_image.loop_count = result.loop_count;
for (auto const& frame : result.frames) {
if (!frame.bitmap)
return {};
decoded_image.frames.empend(move(frame.bitmap), frame.duration);
}