position++; /* skipping one byte */
if (read_mb(&w, map, length, &position) < 0) goto bail;
if (read_mb(&h, map, length, &position) < 0) goto bail;
+
+ /* Wbmp header identifier is too weak....
+ Here checks size validation whether it's acutal wbmp or not. */
+ if (((w * h) >> 3) + position != length)
+ {
+ *error = EVAS_LOAD_ERROR_UNKNOWN_FORMAT;
+ goto bail;
+ }
+
if ((w < 1) || (h < 1) || (w > IMG_MAX_SIZE) || (h > IMG_MAX_SIZE) ||
IMG_TOO_BIG(w, h))
{
if (!map) goto bail;
if (read_mb(&type, map, length, &position) < 0) goto bail;
+
+ if (type != 0)
+ {
+ *error = EVAS_LOAD_ERROR_UNKNOWN_FORMAT;
+ goto bail;
+ }
+
position++; /* skipping one byte */
if (read_mb(&w, map, length, &position) < 0) goto bail;
if (read_mb(&h, map, length, &position) < 0) goto bail;
- if (type != 0)
+ /* Wbmp header identifier is too weak....
+ Here checks size validation whether it's acutal wbmp or not. */
+ if (((w * h) >> 3) + position != length)
{
*error = EVAS_LOAD_ERROR_UNKNOWN_FORMAT;
goto bail;