beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-22 23:50:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

LibGfx+BMP: Remove set_remaining, fix size check

Browse source 
The set_remaining method is inherently dangerous. It can be avoided easily here,
so let's do that.
This commit is contained in:
Ben Wiederhake 2020-12-01 22:51:05 +01:00 committed by Andreas Kling
parent 36daeee34f
commit 453c63fd04
Notes: sideshowbarker 2024-07-19 01:06:31 +09:00 
Author: https://github.com/BenWiederhake
Commit: https://github.com/SerenityOS/serenity/commit/453c63fd049
Pull-request: https://github.com/SerenityOS/serenity/pull/4294
Issue: https://github.com/SerenityOS/serenity/issues/4206
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
Libraries/LibGfx/BMPLoader.cpp
View file

@ -256,7 +256,6 @@ public:
bool has_u32() const { return m_size_remaining >= 4; }
size_t remaining() const { return m_size_remaining; }
void set_remaining(size_t remaining) { m_size_remaining = remaining; }
private:
const u8* m_data_ptr { nullptr };
@ -445,10 +444,12 @@ static bool set_dib_bitmasks(BMPLoadingContext& context, Streamer& streamer)
} else if (type == DIBType::Info && (compression == Compression::BITFIELDS || compression == Compression::ALPHABITFIELDS)) {
// Consume the extra BITFIELDS bytes
auto number_of_mask_fields = compression == Compression::ALPHABITFIELDS ? 4 : 3;
streamer.set_remaining(number_of_mask_fields * 4);
for (auto i = 0; i < number_of_mask_fields; i++)
for (auto i = 0; i < number_of_mask_fields; i++) {
if (!streamer.has_u32())
return false;
context.dib.info.masks.append(streamer.read_u32());
}
populate_dib_mask_info(context);
} else if (type >= DIBType::V2 && compression == Compression::BITFIELDS) {
@ -780,7 +781,7 @@ static bool decode_bmp_dib(BMPLoadingContext& context)
return false;
}
streamer.set_remaining(dib_size - 4);
streamer = Streamer(context.file_bytes + bmp_header_size + 4, context.data_offset - bmp_header_size - 4);
IF_BMP_DEBUG(dbg() << "BMP dib size: " << dib_size);