Skip to content

Commit

Permalink
bmp: don't overflow palette buffer with bogus biClrUsed values.
Browse files Browse the repository at this point in the history
  • Loading branch information
icculus committed Jan 24, 2018
1 parent da6a5c5 commit 071a199
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions IMG_bmp.c
Original file line number Diff line number Diff line change
Expand Up @@ -760,6 +760,11 @@ LoadICOCUR_RW(SDL_RWops * src, int type, int freesrc)
if (biClrUsed == 0) {
biClrUsed = 1 << biBitCount;
}
if (biClrUsed > SDL_arraysize(palette)) {
IMG_SetError("Unsupported or incorrect biClrUsed field");
was_error = SDL_TRUE;
goto done;
}
for (i = 0; i < (int) biClrUsed; ++i) {
SDL_RWread(src, &palette[i], 4, 1);
}
Expand Down

0 comments on commit 071a199

Please sign in to comment.