Skip to content

Commit 453c63f

Browse files
BenWiederhakeawesomekling
authored andcommitted
LibGfx+BMP: Remove set_remaining, fix size check
The set_remaining method is inherently dangerous. It can be avoided easily here, so let's do that.
1 parent 36daeee commit 453c63f

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

Libraries/LibGfx/BMPLoader.cpp

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -256,7 +256,6 @@ class Streamer {
256256
bool has_u32() const { return m_size_remaining >= 4; }
257257

258258
size_t remaining() const { return m_size_remaining; }
259-
void set_remaining(size_t remaining) { m_size_remaining = remaining; }
260259

261260
private:
262261
const u8* m_data_ptr { nullptr };
@@ -445,10 +444,12 @@ static bool set_dib_bitmasks(BMPLoadingContext& context, Streamer& streamer)
445444
} else if (type == DIBType::Info && (compression == Compression::BITFIELDS || compression == Compression::ALPHABITFIELDS)) {
446445
// Consume the extra BITFIELDS bytes
447446
auto number_of_mask_fields = compression == Compression::ALPHABITFIELDS ? 4 : 3;
448-
streamer.set_remaining(number_of_mask_fields * 4);
449447

450-
for (auto i = 0; i < number_of_mask_fields; i++)
448+
for (auto i = 0; i < number_of_mask_fields; i++) {
449+
if (!streamer.has_u32())
450+
return false;
451451
context.dib.info.masks.append(streamer.read_u32());
452+
}
452453

453454
populate_dib_mask_info(context);
454455
} else if (type >= DIBType::V2 && compression == Compression::BITFIELDS) {
@@ -780,7 +781,7 @@ static bool decode_bmp_dib(BMPLoadingContext& context)
780781
return false;
781782
}
782783

783-
streamer.set_remaining(dib_size - 4);
784+
streamer = Streamer(context.file_bytes + bmp_header_size + 4, context.data_offset - bmp_header_size - 4);
784785

785786
IF_BMP_DEBUG(dbg() << "BMP dib size: " << dib_size);
786787

0 commit comments

Comments
 (0)