Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
xcf: deal with bogus data in rle tile decoding.
  • Loading branch information
icculus committed Jan 27, 2018
1 parent 071a199 commit 8b6b94d
Showing 1 changed file with 18 additions and 1 deletion.
19 changes: 18 additions & 1 deletion IMG_xcf.c
Expand Up @@ -486,7 +486,7 @@ static unsigned char * load_xcf_tile_rle (SDL_RWops * src, Uint32 len, int bpp,
t = load = (unsigned char *) SDL_malloc (len);
reallen = SDL_RWread (src, t, 1, len);

data = (unsigned char *) SDL_malloc (x*y*bpp);
data = (unsigned char *) SDL_calloc (1, x*y*bpp);
for (i = 0; i < bpp; i++) {
d = data + i;
size = x*y;
Expand All @@ -503,6 +503,12 @@ static unsigned char * load_xcf_tile_rle (SDL_RWops * src, Uint32 len, int bpp,
t += 2;
}

if (((size_t) (t - load) + length) >= len) {
break; /* bogus data */
} else if (length > size) {
break; /* bogus data */
}

count += length;
size -= length;

Expand All @@ -518,6 +524,12 @@ static unsigned char * load_xcf_tile_rle (SDL_RWops * src, Uint32 len, int bpp,
t += 2;
}

if (((size_t) (t - load)) >= len) {
break; /* bogus data */
} else if (length > size) {
break; /* bogus data */
}

count += length;
size -= length;

Expand All @@ -529,6 +541,11 @@ static unsigned char * load_xcf_tile_rle (SDL_RWops * src, Uint32 len, int bpp,
}
}
}

if (size > 0) {
break; /* just drop out, untouched data initialized to zero. */
}

}

SDL_free (load);
Expand Down

0 comments on commit 8b6b94d

Please sign in to comment.