diff options
author | Nico Weber <thakis@chromium.org> | 2020-11-29 14:37:15 -0500 |
---|---|---|
committer | Andreas Kling <kling@serenityos.org> | 2020-11-29 21:28:44 +0100 |
commit | 34c5478f3133a6d235e91c8004b102f369e842b5 (patch) | |
tree | 8c9ac1b8c9b1e4560a89559deb073e369388f049 /Libraries/LibGfx | |
parent | fe999d6281b0f0c2a5b91f0fb7dade45fd25ba0b (diff) | |
download | serenity-34c5478f3133a6d235e91c8004b102f369e842b5.zip |
LibGfx: Validate bit depths, and don't assert on invalid color type
The PNG spec says that each color type only allows certain bit depths,
so add explicit checks for that.
Diffstat (limited to 'Libraries/LibGfx')
-rw-r--r-- | Libraries/LibGfx/PNGLoader.cpp | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/Libraries/LibGfx/PNGLoader.cpp b/Libraries/LibGfx/PNGLoader.cpp index aa66a20df2..d8a93f12fc 100644 --- a/Libraries/LibGfx/PNGLoader.cpp +++ b/Libraries/LibGfx/PNGLoader.cpp @@ -847,22 +847,32 @@ static bool process_IHDR(const ByteBuffer& data, PNGLoadingContext& context) switch (context.color_type) { case 0: // Each pixel is a grayscale sample. + if (context.bit_depth != 1 && context.bit_depth != 2 && context.bit_depth != 4 && context.bit_depth != 8 && context.bit_depth != 16) + return false; context.channels = 1; break; case 4: // Each pixel is a grayscale sample, followed by an alpha sample. + if (context.bit_depth != 8 && context.bit_depth != 16) + return false; context.channels = 2; break; case 2: // Each pixel is an RGB sample + if (context.bit_depth != 8 && context.bit_depth != 16) + return false; context.channels = 3; break; case 3: // Each pixel is a palette index; a PLTE chunk must appear. + if (context.bit_depth != 1 && context.bit_depth != 2 && context.bit_depth != 4 && context.bit_depth != 8) + return false; context.channels = 1; break; case 6: // Each pixel is an RGB sample, followed by an alpha sample. + if (context.bit_depth != 8 && context.bit_depth != 16) + return false; context.channels = 4; break; default: - ASSERT_NOT_REACHED(); + return false; } return true; } |