crates/bmp/decoder: Check that buf length read isn't out of bounds

crates/zune-bmp/src/decoder.rs

@@ -139,37 +139,37 @@ pub fn probe_bmp(bytes: &[u8]) -> bool {
 /// For some configurations, alpha is disabled,
 #[derive(Clone, Copy, Default, Debug)]
 struct PaletteEntry {
-    red:   u8,
+    red: u8,
     green: u8,
-    blue:  u8,
-    alpha: u8
+    blue: u8,
+    alpha: u8,
 }
 
 /// A BMP decoder.
 pub struct BmpDecoder<T>
-where
-    T: ZReaderTrait
+    where
+        T: ZReaderTrait
 {
-    bytes:           ZByteReader<T>,
-    options:         DecoderOptions,
-    width:           usize,
-    height:          usize,
+    bytes: ZByteReader<T>,
+    options: DecoderOptions,
+    width: usize,
+    height: usize,
     flip_vertically: bool,
-    rgb_bitfields:   [u32; 4],
+    rgb_bitfields: [u32; 4],
     decoded_headers: bool,
-    pix_fmt:         BmpPixelFormat,
-    comp:            BmpCompression,
-    ihszie:          u32,
-    hsize:           u32,
-    palette:         Vec<PaletteEntry>,
-    depth:           u16,
-    is_alpha:        bool,
-    palette_numbers: usize
+    pix_fmt: BmpPixelFormat,
+    comp: BmpCompression,
+    ihszie: u32,
+    hsize: u32,
+    palette: Vec<PaletteEntry>,
+    depth: u16,
+    is_alpha: bool,
+    palette_numbers: usize,
 }
 
 impl<T> BmpDecoder<T>
-where
-    T: ZReaderTrait
+    where
+        T: ZReaderTrait
 {
     /// Create a new bmp decoder that reads data from
     /// `data
@@ -207,7 +207,7 @@ where
             depth: 0,
             palette: vec![],
             is_alpha: false,
-            palette_numbers: 0
+            palette_numbers: 0,
         }
     }
 
@@ -234,7 +234,7 @@ where
         if self.bytes.len() < file_size {
             return Err(BmpDecoderErrors::TooSmallBuffer(
                 file_size,
-                self.bytes.len()
+                self.bytes.len(),
             ));
         }
         // skip 4 reserved bytes
@@ -266,7 +266,7 @@ where
             _ => {
                 return Err(BmpDecoderErrors::GenericStatic(
                     "Unknown information header size"
-                ))
+                ));
             }
         }
 
@@ -279,15 +279,15 @@ where
             return Err(BmpDecoderErrors::TooLargeDimensions(
                 "height",
                 self.options.get_max_height(),
-                self.height
+                self.height,
             ));
         }
 
         if self.width > self.options.get_max_width() {
             return Err(BmpDecoderErrors::TooLargeDimensions(
                 "width",
                 self.options.get_max_width(),
-                self.width
+                self.width,
             ));
         }
         if self.width == 0 {
@@ -323,7 +323,7 @@ where
                 None => {
                     return Err(BmpDecoderErrors::GenericStatic(
                         "Unsupported BMP compression scheme"
-                    ))
+                    ));
                 }
             }
         } else {
@@ -516,7 +516,7 @@ where
         let mut output = vec![
             0_u8;
             self.output_buf_size()
-                .ok_or(BmpDecoderErrors::OverFlowOccurred)?
+                .ok_or(BmpDecoderErrors::OverFlowOccurred)?,
         ];
 
         self.decode_into(&mut output)?;
@@ -626,7 +626,7 @@ where
                                         .zip(bytes.chunks_exact(pad_size))
                                     {
                                         for (a, b) in
-                                            out.chunks_exact_mut(4).zip(input.chunks_exact(4))
+                                        out.chunks_exact_mut(4).zip(input.chunks_exact(4))
                                         {
                                             let v = u32::from_le_bytes(b.try_into().unwrap());
 
@@ -737,7 +737,7 @@ where
                             self.depth as usize,
                             true,
                             in_bytes,
-                            &mut scanline_bytes
+                            &mut scanline_bytes,
                         );
 
                         self.expand_palette(&scanline_bytes, out_bytes, true);
@@ -984,6 +984,9 @@ where
                                 Err(BmpDecoderErrors::Generic(msg))
                             };
                         }
+                        if pos >= buf.len() {
+                            return Err(BmpDecoderErrors::GenericStatic("Invalid image, out of bounds read in pos"));
+                        }
                         // move to the next line
                         buf = &mut buf[pos..];
                         pos = 0;
@@ -1054,7 +1057,7 @@ where
 
                     if pos > buf.len()
                         || buf.len().saturating_sub(pos)
-                            <= (usize::from(p1) * usize::from(self.depth) + 31) / 8
+                        <= (usize::from(p1) * usize::from(self.depth) + 31) / 8
                     {
                         let expected = (usize::from(p1) * usize::from(self.depth)) / 8;
                         let remaining = buf.len().saturating_sub(expected);
@@ -1114,7 +1117,7 @@ where
 
 fn shift_signed(mut v: u32, shift: i32, mut bits: u32) -> u32 {
     const MUL_TABLE: [u32; 9] = [
-        0,    /*Hello world*/
+        0, /*Hello world*/
         0xff, /*0b11111111*/
         0x55, /*0b01010101*/
         0x49, /*0b01001001*/