@@ -136,9 +136,6 @@ static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
136136 Stream_Read_UINT16 (s , iconInfo -> cbBitsMask ); /* cbBitsMask (2 bytes) */
137137 Stream_Read_UINT16 (s , iconInfo -> cbBitsColor ); /* cbBitsColor (2 bytes) */
138138
139- if (Stream_GetRemainingLength (s ) < iconInfo -> cbBitsMask + iconInfo -> cbBitsColor )
140- return FALSE;
141-
142139 /* bitsMask */
143140 newBitMask = (BYTE * )realloc (iconInfo -> bitsMask , iconInfo -> cbBitsMask );
144141
@@ -150,6 +147,8 @@ static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
150147 }
151148
152149 iconInfo -> bitsMask = newBitMask ;
150+ if (Stream_GetRemainingLength (s ) < iconInfo -> cbBitsMask )
151+ return FALSE;
153152 Stream_Read (s , iconInfo -> bitsMask , iconInfo -> cbBitsMask );
154153
155154 /* colorTable */
@@ -184,7 +183,11 @@ static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
184183 }
185184
186185 if (iconInfo -> colorTable )
186+ {
187+ if (Stream_GetRemainingLength (s ) < iconInfo -> cbColorTable )
188+ return FALSE;
187189 Stream_Read (s , iconInfo -> colorTable , iconInfo -> cbColorTable );
190+ }
188191
189192 /* bitsColor */
190193 newBitMask = (BYTE * )realloc (iconInfo -> bitsColor , iconInfo -> cbBitsColor );
@@ -197,6 +200,8 @@ static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
197200 }
198201
199202 iconInfo -> bitsColor = newBitMask ;
203+ if (Stream_GetRemainingLength (s ) < iconInfo -> cbBitsColor )
204+ return FALSE;
200205 Stream_Read (s , iconInfo -> bitsColor , iconInfo -> cbBitsColor );
201206 return TRUE;
202207}
0 commit comments