diff --git a/Userland/Libraries/LibGfx/ImageFormats/JPEG2000Loader.cpp b/Userland/Libraries/LibGfx/ImageFormats/JPEG2000Loader.cpp index 2bffd274aac..2d8c77738d0 100644 --- a/Userland/Libraries/LibGfx/ImageFormats/JPEG2000Loader.cpp +++ b/Userland/Libraries/LibGfx/ImageFormats/JPEG2000Loader.cpp @@ -249,6 +249,8 @@ static ErrorOr parse_codestream_tile_header(JPEG2000LoadingContext& contex tile_bitstream_length = context.codestream_data.size() - context.codestream_cursor - 2; } else { u32 tile_header_length = context.codestream_cursor - tile_start; + if (start_of_tile.tile_part_length < tile_header_length) + return Error::from_string_literal("JPEG2000ImageDecoderPlugin: Invalid tile part length"); tile_bitstream_length = start_of_tile.tile_part_length - tile_header_length; }