:: commit b7176d5cfa119feb0d37e35a8093119a308b5090

mintsuki <mintsuki@protonmail.com> — 2021-09-25 00:02

parents: 5374e4e1f2

bmp: Ensure that bf_offset + bf_size <= file size

diff --git a/stage23/lib/bmp.c b/stage23/lib/bmp.c
index 320ca242..1dada797 100644
--- a/stage23/lib/bmp.c
+++ b/stage23/lib/bmp.c
@@ -40,7 +40,15 @@ int bmp_open_image(struct image *image, struct file_handle *file) {
         return -1;
 
     image->img = ext_mem_alloc(header.bf_size);
-    fread(file, image->img, header.bf_offset, header.bf_size);
+
+    uint32_t bf_size;
+    if (header.bf_offset + header.bf_size > file->size) {
+        bf_size = file->size - header.bf_offset;
+    } else {
+        bf_size = header.bf_size;
+    }
+
+    fread(file, image->img, header.bf_offset, bf_size);
 
     image->x_size     = header.bi_width;
     image->y_size     = header.bi_height;
tab: 248 wrap: offon