LibGfx/TIFF: Reject images with an incoherent number of BitsPerSample

Fixes oss-fuzz issue 66588: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66588
nico · Mar 14, 2024 · 06665cb · 06665cb
1 parent d15785c
commit 06665cb
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/Userland/Libraries/LibGfx/ImageFormats/TIFFLoader.cpp b/Userland/Libraries/LibGfx/ImageFormats/TIFFLoader.cpp
@@ -106,6 +106,12 @@ class TIFFLoadingContext {
         if (any_of(*m_metadata.bits_per_sample(), [](auto bit_depth) { return bit_depth == 0 || bit_depth > 32; }))
             return Error::from_string_literal("TIFFImageDecoderPlugin: Invalid value in BitsPerSample");
 
+        if (m_metadata.bits_per_sample()->size() != m_metadata.samples_per_pixel())
+            return Error::from_string_literal("TIFFImageDecoderPlugin: Invalid number of values in BitsPerSample");
+
+        if (*m_metadata.samples_per_pixel() < samples_for_photometric_interpretation())
+            return Error::from_string_literal("TIFFImageDecoderPlugin: Not enough values in BitsPerSample for given PhotometricInterpretation");
+
         return {};
     }