lbm: Don't overflow static colormap buffer.

icculus · icculus · commit 1559b5ce67e2 · 2018-01-24T12:00:24.000-05:00
diff --git a/IMG_lbm.c b/IMG_lbm.c
@@ -183,6 +183,11 @@ SDL_Surface *IMG_LoadLBM_RW( SDL_RWops *src )
 
         if ( !SDL_memcmp( id, "CMAP", 4 ) ) /* palette ( Color Map ) */
         {
+            if (size > sizeof (colormap)) {
+                error="colormap size is too large";
+                goto done;
+            }
+
             if ( !SDL_RWread( src, &colormap, size, 1 ) )
             {
                 error="error reading CMAP chunk";

Original file line number	Diff line number	Diff line change
`@@ -183,6 +183,11 @@ SDL_Surface IMG_LoadLBM_RW( SDL_RWops src )`
`183`	`183`
`184`	`184`	`if ( !SDL_memcmp( id, "CMAP", 4 ) ) /* palette ( Color Map ) */`
`185`	`185`	`{`
	`186`	`+ if (size > sizeof (colormap)) {`
	`187`	`+ error="colormap size is too large";`
	`188`	`+ goto done;`
	`189`	`+ }`
	`190`	`+`
`186`	`191`	`if ( !SDL_RWread( src, &colormap, size, 1 ) )`
`187`	`192`	`{`
`188`	`193`	`error="error reading CMAP chunk";`