summaryrefslogtreecommitdiff
path: root/Libraries/LibGfx
diff options
context:
space:
mode:
authorNico Weber <thakis@chromium.org>2020-11-29 14:37:15 -0500
committerAndreas Kling <kling@serenityos.org>2020-11-29 21:28:44 +0100
commit34c5478f3133a6d235e91c8004b102f369e842b5 (patch)
tree8c9ac1b8c9b1e4560a89559deb073e369388f049 /Libraries/LibGfx
parentfe999d6281b0f0c2a5b91f0fb7dade45fd25ba0b (diff)
downloadserenity-34c5478f3133a6d235e91c8004b102f369e842b5.zip
LibGfx: Validate bit depths, and don't assert on invalid color type
The PNG spec says that each color type only allows certain bit depths, so add explicit checks for that.
Diffstat (limited to 'Libraries/LibGfx')
-rw-r--r--Libraries/LibGfx/PNGLoader.cpp12
1 files changed, 11 insertions, 1 deletions
diff --git a/Libraries/LibGfx/PNGLoader.cpp b/Libraries/LibGfx/PNGLoader.cpp
index aa66a20df2..d8a93f12fc 100644
--- a/Libraries/LibGfx/PNGLoader.cpp
+++ b/Libraries/LibGfx/PNGLoader.cpp
@@ -847,22 +847,32 @@ static bool process_IHDR(const ByteBuffer& data, PNGLoadingContext& context)
switch (context.color_type) {
case 0: // Each pixel is a grayscale sample.
+ if (context.bit_depth != 1 && context.bit_depth != 2 && context.bit_depth != 4 && context.bit_depth != 8 && context.bit_depth != 16)
+ return false;
context.channels = 1;
break;
case 4: // Each pixel is a grayscale sample, followed by an alpha sample.
+ if (context.bit_depth != 8 && context.bit_depth != 16)
+ return false;
context.channels = 2;
break;
case 2: // Each pixel is an RGB sample
+ if (context.bit_depth != 8 && context.bit_depth != 16)
+ return false;
context.channels = 3;
break;
case 3: // Each pixel is a palette index; a PLTE chunk must appear.
+ if (context.bit_depth != 1 && context.bit_depth != 2 && context.bit_depth != 4 && context.bit_depth != 8)
+ return false;
context.channels = 1;
break;
case 6: // Each pixel is an RGB sample, followed by an alpha sample.
+ if (context.bit_depth != 8 && context.bit_depth != 16)
+ return false;
context.channels = 4;
break;
default:
- ASSERT_NOT_REACHED();
+ return false;
}
return true;
}