LibGfx: Reject OS/2 BMP files with invalid bpp values

1 files changed, 13 insertions, 1 deletions

diff --git a/Libraries/LibGfx/BMPLoader.cpp b/Libraries/LibGfx/BMPLoader.cpp
index 84bada3d65..80cca5610d 100644
--- a/Libraries/LibGfx/BMPLoader.cpp
+++ b/Libraries/LibGfx/BMPLoader.cpp
@@ -543,7 +543,6 @@ static bool decode_bmp_core_dib(BMPLoadingContext& context, Streamer& streamer)
     }
 
     core.bpp = streamer.read_u16();
-
     switch (core.bpp) {
     case 1:
     case 2:
@@ -592,6 +591,19 @@ static bool decode_bmp_osv2_dib(BMPLoadingContext& context, Streamer& streamer,
     }
 
     core.bpp = streamer.read_u16();
+    switch (core.bpp) {
+    case 1:
+    case 2:
+    case 4:
+    case 8:
+    case 24:
+        break;
+    default:
+        // OS/2 didn't expect 16- or 32-bpp to be popular.
+        IF_BMP_DEBUG(dbg() << "BMP has an invalid bpp: " << core.bpp);
+        context.state = BMPLoadingContext::State::Error;
+        return false;
+    }
 
     IF_BMP_DEBUG(dbg() << "BMP width: " << core.width);
     IF_BMP_DEBUG(dbg() << "BMP height: " << core.height);