Fix panics found by fuzzing (#83)

image-rs · Jul 17, 2024 · 1082e86 · 1082e86
1 parent 4c325e0
commit 1082e86
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 59 deletions.
diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
diff --git a/src/lossless.rs b/src/lossless.rs
@@ -286,7 +286,7 @@ impl<R: Read> LosslessDecoder<R> {
         ysize: u16,
         color_cache: Option<ColorCache>,
     ) -> Result<HuffmanInfo, DecodingError> {
-        let mut num_huff_groups = 1;
+        let mut num_huff_groups = 1u32;
 
         let mut huffman_bits = 0;
         let mut huffman_xsize = 1;
@@ -306,8 +306,8 @@ impl<R: Read> LosslessDecoder<R> {
                 .chunks_exact(4)
                 .map(|pixel| {
                     let meta_huff_code = u16::from(pixel[0]) << 8 | u16::from(pixel[1]);
-                    if meta_huff_code >= num_huff_groups {
-                        num_huff_groups = meta_huff_code + 1;
+                    if u32::from(meta_huff_code) >= num_huff_groups {
+                        num_huff_groups = u32::from(meta_huff_code) + 1;
                     }
                     meta_huff_code
                 })

diff --git a/src/lossless_transform.rs b/src/lossless_transform.rs
@@ -274,9 +274,12 @@ pub(crate) fn apply_color_indexing_transform(
             .flat_map(|i| {
                 let mut entry = Vec::new();
                 for j in 0..(1 << width_bits) {
-                    entry.extend_from_slice(
-                        &table_data[(i >> (j * bits_per_entry) & mask) * 4..][..4],
-                    );
+                    let k = i >> (j * bits_per_entry) & mask;
+                    if k < table_size {
+                        entry.extend_from_slice(&table_data[usize::from(k) * 4..][..4]);
+                    } else {
+                        entry.extend_from_slice(&[0; 4]);
+                    }
                 }
                 entry
             })