diff --git a/Libraries/LibGfx/ImageFormats/BMPLoader.cpp b/Libraries/LibGfx/ImageFormats/BMPLoader.cpp index 534a992188a..3b755f406c2 100644 --- a/Libraries/LibGfx/ImageFormats/BMPLoader.cpp +++ b/Libraries/LibGfx/ImageFormats/BMPLoader.cpp @@ -655,10 +655,8 @@ static bool decode_bmp_osv2_dib(BMPLoadingContext& context, InputStreamer& strea return false; } - if (info.number_of_palette_colors > color_palette_limit || info.number_of_important_palette_colors > color_palette_limit) { - dbgln("BMP header indicates too many palette colors: {}", info.number_of_palette_colors); - return false; - } + info.number_of_palette_colors = min(info.number_of_palette_colors, color_palette_limit); + info.number_of_important_palette_colors = min(info.number_of_important_palette_colors, color_palette_limit); // Units (2) + reserved (2) streamer.drop_bytes(4); @@ -703,10 +701,8 @@ static bool decode_bmp_info_dib(BMPLoadingContext& context, InputStreamer& strea info.number_of_palette_colors = streamer.read_u32(); info.number_of_important_palette_colors = streamer.read_u32(); - if (info.number_of_palette_colors > color_palette_limit || info.number_of_important_palette_colors > color_palette_limit) { - dbgln("BMP header indicates too many palette colors: {}", info.number_of_palette_colors); - return false; - } + info.number_of_palette_colors = min(info.number_of_palette_colors, color_palette_limit); + info.number_of_important_palette_colors = min(info.number_of_important_palette_colors, color_palette_limit); if (info.number_of_important_palette_colors == 0) info.number_of_important_palette_colors = info.number_of_palette_colors; diff --git a/Tests/LibGfx/TestImageDecoder.cpp b/Tests/LibGfx/TestImageDecoder.cpp index c2b9ee55179..e3ee514971c 100644 --- a/Tests/LibGfx/TestImageDecoder.cpp +++ b/Tests/LibGfx/TestImageDecoder.cpp @@ -75,6 +75,15 @@ TEST_CASE(test_bmp_1bpp) EXPECT_EQ(frame.image->begin()[0], 0xff'ff'ff'ff); } +TEST_CASE(test_bmp_too_many_palette_colors) +{ + auto file = TRY_OR_FAIL(Core::MappedFile::map(TEST_INPUT("bmp/too-many-palette-colors.bmp"sv))); + EXPECT(Gfx::BMPImageDecoderPlugin::sniff(file->bytes())); + auto plugin_decoder = TRY_OR_FAIL(Gfx::BMPImageDecoderPlugin::create(file->bytes())); + + TRY_OR_FAIL(expect_single_frame_of_size(*plugin_decoder, { 2, 2 })); +} + TEST_CASE(test_ico_malformed_frame) { Array test_inputs = { diff --git a/Tests/LibGfx/test-inputs/bmp/too-many-palette-colors.bmp b/Tests/LibGfx/test-inputs/bmp/too-many-palette-colors.bmp new file mode 100644 index 00000000000..4bda17d5fa4 Binary files /dev/null and b/Tests/LibGfx/test-inputs/bmp/too-many-palette-colors.bmp differ