602e7fe2bd
Problem: A BMP V5 image whose embedded ICC profile offset points past the end of the file triggers an OOB read. Cause: The bounds check summed the profile offset, the file-header size, and the profile size in 32-bit arithmetic. So, a large offset (e.g. 0xfffffff0) wraps the sum back into range and passes the check. The decoder then returns a span pointing far past the end of the file. Fix: Compute the sum in 64 bits — so an out-of-bounds offset can no longer wrap, and the profile’s rejected. Fixes: https://github.com/LadybirdBrowser/ladybird/issues/9967 |
||
|---|---|---|
| .. | ||
| test-inputs | ||
| BenchmarkJPEGLoader.cpp | ||
| CMakeLists.txt | ||
| TestBitmapExport.cpp | ||
| TestColor.cpp | ||
| TestImageDecoder.cpp | ||
| TestImageWriter.cpp | ||
| TestQuad.cpp | ||
| TestRect.cpp | ||
| TestWOFF.cpp | ||
| TestWOFF2.cpp | ||
| TestYUVData.cpp | ||