Skip to content

Commit

Permalink
LibGfx/JBIG2: Fix size bound in scan_for_immediate_generic_region_size()
Browse files Browse the repository at this point in the history
The memmem() call passes `data.size() - 19 - sizeof(u32)` for big_len,
(18 prefix bytes skipped, the flag byte, and the trailing u32), so the
buffer needs to be at least that large.

Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67332
  • Loading branch information
nico committed Mar 13, 2024
1 parent 9aefc5c commit 2f4d55c
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions Userland/Libraries/LibGfx/ImageFormats/JBIG2Loader.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -306,8 +306,8 @@ static ErrorOr<size_t> scan_for_immediate_generic_region_size(ReadonlyBytes data
// Thus, those sequences cannot occur by chance in the data that is decoded to generate the contents of the generic region."
dbgln_if(JBIG2_DEBUG, "(Unknown data length, computing it)");

if (data.size() < 18)
return Error::from_string_literal("JBIG2ImageDecoderPlugin: Data too short to contain segment data header");
if (data.size() < 19 + sizeof(u32))
return Error::from_string_literal("JBIG2ImageDecoderPlugin: Data too short to contain segment data header and end sequence");

// Per 7.4.6.1 Generic region segment data header, this starts with the 17 bytes described in
// 7.4.1 Region segment information field, followed the byte described in 7.4.6.2 Generic region segment flags.
Expand Down

0 comments on commit 2f4d55c

Please sign in to comment.