Skip to content

Commit b78622d

Browse files
LucasCholletgmta
authored andcommitted
LibGfx/PortableFormat: Reject images with a maximum value of 0
These images can't contain any meaningful information, so no need to try to decode them. Doing so result in a `SIGFPE`, as we divide by this value later on. Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57434&sort=-opened&can=1&q=proj%3Aserenity
1 parent 800a009 commit b78622d

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

Userland/Libraries/LibGfx/ImageFormats/PortableImageLoaderCommon.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,11 @@ static ErrorOr<void> read_max_val(TContext& context)
153153
{
154154
context.format_details.max_val = TRY(read_number(*context.stream));
155155

156+
if (context.format_details.max_val == 0) {
157+
context.state = TContext::State::Error;
158+
return Error::from_string_literal("The image has a maximum value of 0");
159+
}
160+
156161
if (context.format_details.max_val > 255) {
157162
dbgln_if(PORTABLE_IMAGE_LOADER_DEBUG, "We can't parse 2 byte color for {}", TContext::FormatDetails::image_type);
158163
context.state = TContext::State::Error;

0 commit comments

Comments
 (0)