diff --git a/Libraries/LibGfx/ImageFormats/BMPLoader.cpp b/Libraries/LibGfx/ImageFormats/BMPLoader.cpp index d9f9a15c51..9596dd7864 100644 --- a/Libraries/LibGfx/ImageFormats/BMPLoader.cpp +++ b/Libraries/LibGfx/ImageFormats/BMPLoader.cpp @@ -1297,8 +1297,9 @@ static ErrorOr decode_bmp_pixel_data(BMPLoadingContext& context) return Error::from_string_literal("BMP has invalid bpp"); } - u32 const width = abs(context.dib.core.width); - u32 const height = !context.is_included_in_ico ? abs(context.dib.core.height) : (abs(context.dib.core.height) / 2); + u32 const width = static_cast(abs(static_cast(context.dib.core.width))); + u32 const absolute_height = static_cast(abs(static_cast(context.dib.core.height))); + u32 const height = !context.is_included_in_ico ? absolute_height : (absolute_height / 2); context.bitmap = TRY(Bitmap::create(format, Gfx::AlphaType::Unpremultiplied, { static_cast(width), static_cast(height) })); diff --git a/Tests/LibGfx/TestImageDecoder.cpp b/Tests/LibGfx/TestImageDecoder.cpp index dbfef414f0..6a7b14a010 100644 --- a/Tests/LibGfx/TestImageDecoder.cpp +++ b/Tests/LibGfx/TestImageDecoder.cpp @@ -92,6 +92,13 @@ TEST_CASE(test_bmp_v4) EXPECT_EQ(frame.image->get_pixel(0, 0), Gfx::Color::NamedColor::Red); } +TEST_CASE(test_bmp_negative_int_min_height) +{ + auto file = TRY_OR_FAIL(Core::MappedFile::map(TEST_INPUT("bmp/negative-height-int-min.bmp"sv))); + auto plugin_decoder = TRY_OR_FAIL(Gfx::BMPImageDecoderPlugin::create(file->bytes())); + EXPECT(plugin_decoder->frame(0).is_error()); +} + TEST_CASE(test_bmp_os2_3bit) { auto file = TRY_OR_FAIL(Core::MappedFile::map(TEST_INPUT("bmp/os2_3bpc.bmp"sv))); diff --git a/Tests/LibGfx/test-inputs/bmp/negative-height-int-min.bmp b/Tests/LibGfx/test-inputs/bmp/negative-height-int-min.bmp new file mode 100644 index 0000000000..0ad313d370 Binary files /dev/null and b/Tests/LibGfx/test-inputs/bmp/negative-height-int-min.bmp differ