Add check, if Offset is greater then stream length when reading colorMapSize

2 months ago · 4b983db6b2
1 changed files with 6 additions and 0 deletions
--- a/src/ImageSharp/Formats/Bmp/BmpDecoderCore.cs
+++ b/src/ImageSharp/Formats/Bmp/BmpDecoderCore.cs
@ -1548,6 +1548,12 @@ internal sealed class BmpDecoderCore : ImageDecoderCore
                    case BmpFileMarkerType.Bitmap:
                        if (this.fileHeader.HasValue)
                        {
+                            if (this.fileHeader.Value.Offset > stream.Length)
+                            {
+                                BmpThrowHelper.ThrowInvalidImageContentException(
+                                    $"Pixel data offset {this.fileHeader.Value.Offset} exceeds file size {stream.Length}.");
+                            }
+
                            colorMapSizeBytes = this.fileHeader.Value.Offset - BmpFileHeader.Size - this.infoHeader.HeaderSize;
                        }
                        else