LibGfx/ILBM: Ensure CMAP chunk size matches expected value

The color map should be 3 bytes per pixel and should contain `2^nPlanes` pixels. We now return an error if the color map isn't the size we expect.
lanmonster · Nov 8, 2023 · f56ae8c · f56ae8c
1 parent 61eb754
commit f56ae8c
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 0 deletions.
diff --git a/Tests/LibGfx/TestImageDecoder.cpp b/Tests/LibGfx/TestImageDecoder.cpp
@@ -154,6 +154,7 @@ TEST_CASE(test_ilbm_malformed_header)
 TEST_CASE(test_ilbm_malformed_frame)
 {
  Array test_inputs = {
+ TEST_INPUT("ilbm/incorrect-cmap-size.iff"sv),
  TEST_INPUT("ilbm/incorrect-uncompressed-size.iff"sv),
  TEST_INPUT("ilbm/missing-body-chunk.iff"sv)
  };

diff --git a/Tests/LibGfx/test-inputs/ilbm/incorrect-cmap-size.iff b/Tests/LibGfx/test-inputs/ilbm/incorrect-cmap-size.iff
diff --git a/Userland/Libraries/LibGfx/ImageFormats/ILBMLoader.cpp b/Userland/Libraries/LibGfx/ImageFormats/ILBMLoader.cpp
@@ -298,6 +298,9 @@ static ErrorOr<void> decode_iff_chunks(ILBMLoadingContext& context)
  while (!chunks.is_empty()) {
  auto chunk = TRY(decode_iff_advance_chunk(chunks));
  if (chunk.type == FourCC("CMAP")) {
+ if (chunk.data.size() != (1ul << context.bm_header.planes) * 3)
+ return Error::from_string_literal("Invalid CMAP chunk size");
+
  context.color_table = TRY(decode_cmap_chunk(chunk));
  } else if (chunk.type == FourCC("BODY")) {
  if (context.color_table.is_empty())