Skip to content

Commit

Permalink
Check for BMP vertical inversion before validating the image size
Browse files Browse the repository at this point in the history
  • Loading branch information
aaaaaa123456789 committed Jan 29, 2022
1 parent 568e8c1 commit 94e1fbf
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 1 deletion.
1 change: 1 addition & 0 deletions docs/changelog.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ Note: releases are listed from latest to oldest.
reduction occured at the same time
- Fixed a file descriptor leak that would keep an open `FILE *` if a `PLUM_ERR_FILE_ERROR` error was raised while
reading from a file
- Fixed a bug that prevented non-vertically-flipped BMP files from ever loading
- Added safeguards to prevent internal `longjmp` misuse when generating image files
- Ensured that the `PLUM_FILENAME`, `PLUM_BUFFER` and `PLUM_CALLBACK` constants are always `size_t` as documented
- Enforced the size limitation on the value returned by a callback when using the `PLUM_CALLBACK` loading/storing mode
Expand Down
2 changes: 1 addition & 1 deletion src/bmpread.c
Original file line number Diff line number Diff line change
Expand Up @@ -11,12 +11,12 @@ void load_BMP_data (struct context * context, unsigned flags, size_t limit) {
context -> image -> width = read_le32_unaligned(context -> data + 18);
context -> image -> height = read_le32_unaligned(context -> data + 22);
if (context -> image -> width > 0x7fffffffu) throw(context, PLUM_ERR_INVALID_FILE_FORMAT);
validate_image_size(context, limit);
int inverted = 1;
if (context -> image -> height > 0x7fffffffu) {
context -> image -> height = -context -> image -> height;
inverted = 0;
}
validate_image_size(context, limit);
if (read_le16_unaligned(context -> data + 26) != 1) throw(context, PLUM_ERR_INVALID_FILE_FORMAT);
uint_fast16_t bits = read_le16_unaligned(context -> data + 28);
uint_fast32_t compression = read_le32_unaligned(context -> data + 30);
Expand Down

0 comments on commit 94e1fbf

Please sign in to comment.