mirror/kimageformats
1
0
Fork 0
mirror of https://invent.kde.org/frameworks/kimageformats.git synced 2025-05-28 00:30:23 -04:00
Code Issues Packages Projects Releases Wiki Activity

ani: Read chunk elements one at a time instead all at once

Browse Source 
This way if the file is malformed and there's not that many elements we don't
try allocate too much memory to read into

BUGS: 498368
This commit is contained in:
Albert Astals Cid 2025-01-14 00:37:20 +01:00
parent f296c38daf
commit f39ca9dc9b
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/imageformats/ani.cpp
View File

@ -376,16 +376,18 @@ bool ANIHandler::ensureScanned() const
mutableThis->m_imageCount = aniHeader->nSteps; mutableThis->m_imageCount = aniHeader->nSteps;
mutableThis->m_displayRate = aniHeader->iDispRate; mutableThis->m_displayRate = aniHeader->iDispRate;
} else if (chunkId == "rate" || chunkId == "seq ") { } else if (chunkId == "rate" || chunkId == "seq ") {
const QByteArray data = device()->read(chunkSize); if (chunkSize % sizeof(quint32_le) != 0) {
if (static_cast<quint32_le>(data.size()) != chunkSize || data.size() % sizeof(quint32_le) != 0) {
return false; return false;
} }
// TODO should we check that the number of rate entries matches nSteps? // TODO should we check that the number of rate entries matches nSteps?
auto *dataPtr = data.data();
QList<int> list; QList<int> list;
for (int i = 0; i < data.size(); i += sizeof(quint32_le)) { for (unsigned int i = 0; i < chunkSize; i += sizeof(quint32_le)) {
const auto entry = *(reinterpret_cast<const quint32_le *>(dataPtr + i)); const QByteArray data = device()->read(sizeof(quint32_le));
if (data.size() != sizeof(quint32_le)) {
return false;
}
const auto entry = *(reinterpret_cast<const quint32_le *>(data.data()));
list.append(entry); list.append(entry);
} }