beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-22 07:30:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

LibGfx/ILBM: Avoid buffer overruns when decompressing data

Browse source
This commit is contained in:
Tim Ledbetter 2023-10-30 18:57:10 +00:00 committed by Andreas Kling
parent ae6c39e501
commit 75731f9c50
Notes: sideshowbarker 2024-07-17 03:35:24 +09:00 
Author: https://github.com/tcl3
Commit: https://github.com/SerenityOS/serenity/commit/75731f9c50
Pull-request: https://github.com/SerenityOS/serenity/pull/21699
Reviewed-by: https://github.com/warpdesign
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
Userland/Libraries/LibGfx/ImageFormats/ILBMLoader.cpp
View file

@ -191,11 +191,20 @@ static ErrorOr<ByteBuffer> uncompress_byte_run(ReadonlyBytes data, ILBMLoadingCo
auto const byte = static_cast<i8>(data[read_bytes++]);
if (byte >= -127 && byte <= -1) {
// read next byte
if (read_bytes == data.size())
return Error::from_string_literal("Malformed compressed data");
u8 next_byte = data[read_bytes++];
if (index + -byte >= plane_data.size())
return Error::from_string_literal("Malformed compressed data");
for (u16 i = 0; i < -byte + 1; ++i) {
plane_data[index++] = next_byte;
}
} else if (byte >= 0) {
if (index + byte >= plane_data_size || read_bytes + byte >= length)
return Error::from_string_literal("Malformed compressed data");
for (u16 i = 0; i < byte + 1; ++i) {
plane_data[index] = data[read_bytes];
read_bytes++;