BMPUtils: get rid of extra allocation on loading file, discard BMPs t…

…hat's smaller than data size values

BMPUtils.h

@@ -55,7 +55,7 @@ class CBMP
 {
 public:
 	static CBMP* LoadFile( const char *filename ); // implemented in library!
-	
+
 	CBMP( uint w, uint h )
 	{
 		bmp_t bhdr;
@@ -81,12 +81,22 @@ class CBMP
 		bhdr.colors = ( pixel_size == 1 ) ? 256 : 0;
 		bhdr.importantColors = 0;
 
+		fileAllocated = false;
 		data = new byte[bhdr.fileSize];
 		memcpy( data, &bhdr, sizeof( bhdr ));
 		memset( data + bhdr.bitmapDataOffset, 0, bhdr.bitmapDataSize );
 	}
 
-	~CBMP() { if( data ) delete []data; }
+	~CBMP()
+	{
+		if( data )
+		{
+			if( fileAllocated )
+				EngFuncs::COM_FreeFile( data );
+			else
+				delete []data;
+		}
+	}
 
 	void Increase(uint w, uint h)
 	{
@@ -172,7 +182,12 @@ class CBMP
 		return (rgbquad_t*)(data + sizeof( bmp_t ));
 	}
 
-
 private:
-	byte    *data;
+	CBMP( bmp_t *data ) :
+		fileAllocated( true ), data( (byte*)data )
+	{
+	}
+
+	bool fileAllocated;
+	byte *data;
 };

Utils.cpp

@@ -413,10 +413,17 @@ CBMP* CBMP::LoadFile( const char *filename )
 	if( !bmp->width || !bmp->height )
 		return NULL;
 
-	CBMP *ret = new CBMP( bmp->width, bmp->height );
-	memcpy( ret->GetBitmap(), bmp, length );
+	// validate all nasty data size fields
+	if( length < bmp->fileSize ||
+		 length < bmp->bitmapDataSize ||
+		 length < bmp->bitmapDataOffset ||
+		 length < bmp->bitmapHeaderSize ||
+		 length < bmp->bitmapDataOffset + bmp->bitmapDataSize ||
+		 length < bmp->bitmapHeaderSize + bmp->bitmapDataSize )
+		return NULL;
 
-	EngFuncs::COM_FreeFile( bmp );
+	// will be freed in destructor
+	CBMP *ret = new CBMP( bmp );
 
 	return ret;
 }