commit 1878dc9037915f9906553caf550475f6f0998bfa
author Nigel Tao <nigeltao@golang.org> Mon Dec 14 09:46:34 2020 +1100
committer Nigel Tao <nigeltao@golang.org> Mon Dec 14 09:49:16 2020 +1100
tree e1c5b83e2e5d238f64f89c29e9161bd1df3c6f5b
parent f880d644fa0e244a209faafc6a9de6b02164b43c

Have std/bmp detect bad RLE compression

release/c/wuffs-unsupported-snapshot.c

diff --git a/release/c/wuffs-unsupported-snapshot.c b/release/c/wuffs-unsupported-snapshot.c
index 4cc5d6e..0019448 100644
--- a/release/c/wuffs-unsupported-snapshot.c
+++ b/release/c/wuffs-unsupported-snapshot.c
@@ -5445,6 +5445,7 @@
 // ---------------- Status Codes
 
 extern const char wuffs_bmp__error__bad_header[];
+extern const char wuffs_bmp__error__bad_rle_compression[];
 extern const char wuffs_bmp__error__unsupported_bmp_file[];
 
 // ---------------- Public Consts
@@ -16110,6 +16111,7 @@
 // ---------------- Status Codes Implementations
 
 const char wuffs_bmp__error__bad_header[] = "#bmp: bad header";
+const char wuffs_bmp__error__bad_rle_compression[] = "#bmp: bad RLE compression";
 const char wuffs_bmp__error__unsupported_bmp_file[] = "#bmp: unsupported BMP file";
 const char wuffs_bmp__note__internal_note_short_read[] = "@bmp: internal note: short read";
 
@@ -17818,6 +17820,10 @@
             wuffs_base__pixel_swizzler__swizzle_interleaved_transparent_black(&self->private_impl.f_swizzler, v_dst, v_dst_palette, ((uint64_t)(self->private_impl.f_rle_delta_x)));
             wuffs_base__u32__sat_add_indirect(&self->private_impl.f_dst_x, ((uint32_t)(self->private_impl.f_rle_delta_x)));
             self->private_impl.f_rle_delta_x = 0;
+            if (self->private_impl.f_dst_x > self->private_impl.f_width) {
+              status = wuffs_base__make_status(wuffs_bmp__error__bad_rle_compression);
+              goto exit;
+            }
           }
           if (v_code > 0) {
 #if defined(__GNUC__)
@@ -17830,6 +17836,10 @@
 #endif
             while (true) {
               self->private_impl.f_dst_y += self->private_impl.f_dst_y_inc;
+              if (self->private_impl.f_dst_y == self->private_impl.f_dst_y_end) {
+                status = wuffs_base__make_status(wuffs_bmp__error__bad_rle_compression);
+                goto exit;
+              }
               v_row = wuffs_base__table_u8__row(v_tab, self->private_impl.f_dst_y);
               if (v_dst_bytes_per_row < ((uint64_t)(v_row.len))) {
                 v_row = wuffs_base__slice_u8__subslice_j(v_row, v_dst_bytes_per_row);

std/bmp/decode_bmp.wuffs

diff --git a/std/bmp/decode_bmp.wuffs b/std/bmp/decode_bmp.wuffs
index eb9eab9..50d0622 100644
--- a/std/bmp/decode_bmp.wuffs
+++ b/std/bmp/decode_bmp.wuffs
@@ -13,6 +13,7 @@
 // limitations under the License.
 
 pub status "#bad header"
+pub status "#bad RLE compression"
 pub status "#unsupported BMP file"
 
 pri status "@internal note: short read"
@@ -733,6 +734,9 @@
 						num_pixels: this.rle_delta_x as base.u64)
 					this.dst_x ~sat+= this.rle_delta_x as base.u32
 					this.rle_delta_x = 0
+					if this.dst_x > this.width {
+						return "#bad RLE compression"
+					}
 				}
 
 				// Paint the skipped rows (and the partial final row) with
@@ -741,6 +745,9 @@
 					code -= 1
 					while true {
 						this.dst_y ~mod+= this.dst_y_inc
+						if this.dst_y == this.dst_y_end {
+							return "#bad RLE compression"
+						}
 						row = tab.row(y: this.dst_y)
 						if dst_bytes_per_row < row.length() {
 							row = row[.. dst_bytes_per_row]