602e7fe2bd
Problem: A BMP V5 image whose embedded ICC profile offset points past the end of the file triggers an OOB read. Cause: The bounds check summed the profile offset, the file-header size, and the profile size in 32-bit arithmetic. So, a large offset (e.g. 0xfffffff0) wraps the sum back into range and passes the check. The decoder then returns a span pointing far past the end of the file. Fix: Compute the sum in 64 bits — so an out-of-bounds offset can no longer wrap, and the profile’s rejected. Fixes: https://github.com/LadybirdBrowser/ladybird/issues/9967 |
||
|---|---|---|
| .. | ||
| 2x2x32_v4.bmp | ||
| bitmap.bmp | ||
| negative-height-int-min.bmp | ||
| os2_3bpc.bmp | ||
| oss-fuzz-testcase-62541.bmp | ||
| rgba32-1.bmp | ||
| rle24.bmp | ||
| too-many-palette-colors.bmp | ||
| top-down.bmp | ||
| v5-icc-profile-out-of-bounds.bmp | ||
