Ticket #12207: 0001-12207-fix-an-infinite-loop-on-reading-a-larger-file-.patch

src/tools/hvif2png/hvif2png.cpp

@@ -31 +31 @@
 #define SIZE_HVIF_BUFFER_STEP 1024
 
 
+static const uint8 kHvifMagic[] = { 'n', 'c', 'i', 'f' };
+
+
 typedef struct h2p_hvif_buffer {
     uint8*  buffer;
     size_t  used;
@@ -195 +198 @@
                 fprintf(stderr,"out of memory\n");
                 return 0;
             }
+
+            result->allocated += SIZE_HVIF_BUFFER_STEP;
         }
 
         result->used += fread(&result->buffer[result->used], sizeof(uint8),
@@ -208 +213 @@
         }
     }
 
+    if (result->used < 4) {
+        fprintf(stderr, "the hvif data is too small to visably be valid\n");
+        return 0;
+    }
+
+
+    // hvif files have a magic string of "ncif" so we should check for that as
+    // well.
+
+    if (memcmp(result->buffer, kHvifMagic, 4) != 0) {
+        fprintf(stderr, "the input data does not look like hvif because the"
+            " magic string is not 'ncif'; %d, %d, %d, %d\n",
+            result->buffer[0], result->buffer[1], result->buffer[2],
+            result->buffer[3]);
+        return 0;
+    }
+
     return result->used;
 }