Fix issue #15 / CVE-2006-3668

ZDoom · Dec 15, 2015 · 17a216c · 17a216c
1 parent e5a4031
commit 17a216c
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/dumb/src/it/itread.c b/dumb/src/it/itread.c
@@ -290,12 +290,15 @@ static int it_read_envelope(IT_ENVELOPE *envelope, DUMBFILE *f)
 
 	envelope->flags = dumbfile_getc(f);
 	envelope->n_nodes = dumbfile_getc(f);
+	if(envelope->n_nodes > 25) {
+		TRACE("IT error: wrong number of envelope nodes (%d)\n", envelope->n_nodes);
+		envelope->n_nodes = 0;
+		return -1;
+	}
 	envelope->loop_start = dumbfile_getc(f);
 	envelope->loop_end = dumbfile_getc(f);
 	envelope->sus_loop_start = dumbfile_getc(f);
 	envelope->sus_loop_end = dumbfile_getc(f);
-	if (envelope->n_nodes > 25)
-		envelope->n_nodes = 25;
 	for (n = 0; n < envelope->n_nodes; n++) {
 		envelope->node_y[n] = dumbfile_getc(f);
 		envelope->node_t[n] = dumbfile_igetw(f);