LibGfx: Let the PNG decoder fail if the header is missing or too short

1 files changed, 6 insertions, 0 deletions

diff --git a/Libraries/LibGfx/PNGLoader.cpp b/Libraries/LibGfx/PNGLoader.cpp
index 9ca965c421..5389ae0b47 100644
--- a/Libraries/LibGfx/PNGLoader.cpp
+++ b/Libraries/LibGfx/PNGLoader.cpp
@@ -419,6 +419,12 @@ static bool decode_png_header(PNGLoadingContext& context)
     if (context.state >= PNGLoadingContext::HeaderDecoded)
         return true;
 
+    if (!context.data || context.data_size < sizeof(png_header)) {
+        dbg() << "Missing PNG header";
+        context.state = PNGLoadingContext::State::Error;
+        return false;
+    }
+
     if (memcmp(context.data, png_header, sizeof(png_header)) != 0) {
         dbg() << "Invalid PNG header";
         context.state = PNGLoadingContext::State::Error;