mirror/kimageformats
1
0
Fork 0
mirror of https://invent.kde.org/frameworks/kimageformats.git synced 2025-06-03 17:08:08 -04:00
Code Issues Packages Projects Releases Wiki Activity

xcf: loadHierarchy: Obey the layer.type and not the bpp

Browse Source 
Otherwise we end up doing uninitialized memory reads on broken/fuzzed
files

oss-fuzz/12761
This commit is contained in:
Albert Astals Cid 2019-01-29 20:36:15 +01:00
parent 18e17d3a7a
commit 1bad780baa
1 changed files with 41 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
src/imageformats/xcf.cpp
View File

@ -27,7 +27,7 @@
#include <QIODevice>
#include <QStack>
#include <QVector>
// #include <QDebug>
#include <QDebug>
#include <string.h>
@ -970,6 +970,46 @@ bool XCFImageFormat::loadHierarchy(QDataStream &xcf_io, Layer &layer)
xcf_io >> width >> height >> bpp >> offset;
// make sure bpp is correct and complain if it is not
switch (layer.type) {
case RGB_GIMAGE:
if (bpp != 3) {
qWarning() << "Found layer of type RGB but with bpp != 3" << bpp;
bpp = 3;
}
break;
case RGBA_GIMAGE:
if (bpp != 4) {
qWarning() << "Found layer of type RGBA but with bpp != 4" << bpp;
bpp = 4;
}
break;
case GRAY_GIMAGE:
if (bpp != 1) {
qWarning() << "Found layer of type Gray but with bpp != 1" << bpp;
bpp = 1;
}
break;
case GRAYA_GIMAGE:
if (bpp != 2) {
qWarning() << "Found layer of type Gray+Alpha but with bpp != 2" << bpp;
bpp = 2;
}
break;
case INDEXED_GIMAGE:
if (bpp != 1) {
qWarning() << "Found layer of type Indexed but with bpp != 1" << bpp;
bpp = 1;
}
break;
case INDEXEDA_GIMAGE:
if (bpp != 2) {
qWarning() << "Found layer of type Indexed+Alpha but with bpp != 2" << bpp;
bpp = 2;
}
break;
}
// GIMP stores images in a "mipmap"-like format (multiple levels of
// increasingly lower resolution). Only the top level is used here,
// however.