LibGfx: add bounds checking before set_pixel call in GIF decoder

This fixes a crash when a GIF frame extends beyond the limits of the logical screen, causing writes past the end of the frame buffer
lanmonster · Nov 1, 2020 · 5567408 · 5567408
1 parent a28f29c
commit 5567408
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/Libraries/LibGfx/GIFLoader.cpp b/Libraries/LibGfx/GIFLoader.cpp
@@ -355,7 +355,7 @@ static bool decode_frame(GIFLoadingContext& context, size_t frame_index)
  int x = pixel_index % image.width + image.x;
  int y = row + image.y;
 
- if (!image.transparent || color != image.transparency_index) {
+ if (context.frame_buffer->rect().contains(x, y) && (!image.transparent || color != image.transparency_index)) {
  context.frame_buffer->set_pixel(x, y, c);
  }