Browse Source

LibGfx/ICC: Ensure Macintosh ScriptCode length is within expected range

Previously, it was possible for a `TextDescriptionTagData` object with
an incorrect Macintosh ScriptCode description length to cause a buffer
overflow.
Tim Ledbetter 1 năm trước cách đây
mục cha
commit
f87d93b4ee

+ 4 - 1
Userland/Libraries/LibGfx/ICC/TagTypes.cpp

@@ -1151,7 +1151,10 @@ ErrorOr<NonnullRefPtr<TextDescriptionTagData>> TextDescriptionTagData::from_byte
     u8 macintosh_description_length = *cursor;
     u8 macintosh_description_length = *cursor;
     cursor += 1;
     cursor += 1;
 
 
-    if (macintosh_description_length > 67)
+    Checked<u32> macintosh_description_end = unicode_desciption_end;
+    macintosh_description_end += 3;
+    macintosh_description_end += macintosh_description_length;
+    if (macintosh_description_length > 67 || macintosh_description_end.has_overflow() || macintosh_description_end.value() > bytes.size())
         return Error::from_string_literal("ICC::Profile: textDescriptionType ScriptCode description too long");
         return Error::from_string_literal("ICC::Profile: textDescriptionType ScriptCode description too long");
 
 
     u8 const* macintosh_description_data = cursor;
     u8 const* macintosh_description_data = cursor;