This is an automated email from the git hooks/post-receive script.
git pushed a commit to branch master
in repository legacy-imlib2.
View the commit online.
commit 4405f6203b0fdef6363193a8b61330d0757be44d
Author: Acts1631 <[email protected]>
AuthorDate: Sat Jul 18 09:05:12 2026 -0400
ico: validate palette size for indexed images
The loader accepted a palette smaller than the format's index range
and later used an untrusted pixel index without bounds checking.
This could read beyond the allocated palette.
Reject indexed icons whose declared palette cannot cover their
bit depth.
---
src/modules/loaders/loader_ico.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/modules/loaders/loader_ico.c b/src/modules/loaders/loader_ico.c
index f6ba77d..6d50366 100644
--- a/src/modules/loaders/loader_ico.c
+++ b/src/modules/loaders/loader_ico.c
@@ -190,6 +190,8 @@ ico_read_icon(ico_t *ico, int ino)
case 1:
case 4:
case 8:
+ if (ie->bih.colors < (1U << ie->bih.bpp))
+ goto bail;
DL("Allocating a %d slot colormap\n", ie->bih.colors);
if (UINT_MAX / sizeof(uint32_t) < ie->bih.colors)
goto bail;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
