llimage merge

indra/llimage/llimagebmp.cpp

@@ -449,6 +449,10 @@ BOOL LLImageBMP::decodeColorMask32( U8* dst, U8* src )
 		mBitfieldMask[2] = 0x000000FF;
 	}
 
+	if (getWidth() * getHeight() * 4 > getDataSize() - mBitmapOffset)
+	{ //here we have situation when data size in src less than actually needed
+		return FALSE;
+	}
 
 	S32 src_row_span = getWidth() * 4;
 	S32 alignment_bytes = (3 * src_row_span) % 4;  // round up to nearest multiple of 4
@@ -482,6 +486,11 @@ BOOL LLImageBMP::decodeColorTable8( U8* dst, U8* src )
 	S32 src_row_span = getWidth() * 1;
 	S32 alignment_bytes = (3 * src_row_span) % 4;  // round up to nearest multiple of 4
 
+	if ((getWidth() * getHeight()) + getHeight() * alignment_bytes > getDataSize() - mBitmapOffset)
+	{ //here we have situation when data size in src less than actually needed
+		return FALSE;
+	}
+
 	for( S32 row = 0; row < getHeight(); row++ )
 	{
 		for( S32 col = 0; col < getWidth(); col++ )
@@ -507,6 +516,11 @@ BOOL LLImageBMP::decodeTruecolor24( U8* dst, U8* src )
 	S32 src_row_span = getWidth() * 3;
 	S32 alignment_bytes = (3 * src_row_span) % 4;  // round up to nearest multiple of 4
 
+	if ((getWidth() * getHeight() * 3) + getHeight() * alignment_bytes > getDataSize() - mBitmapOffset)
+	{ //here we have situation when data size in src less than actually needed
+		return FALSE;
+	}
+
 	for( S32 row = 0; row < getHeight(); row++ )
 	{
 		for( S32 col = 0; col < getWidth(); col++ )

indra/llimage/llimagetga.cpp

@@ -437,7 +437,13 @@ BOOL LLImageTGA::decodeTruecolorNonRle( LLImageRaw* raw_image, BOOL &alpha_opaqu
 	// Origin is the bottom left
 	U8* dst = raw_image->getData();
 	U8* src = getData() + mDataOffset;
+
 	S32 pixels = getWidth() * getHeight();
+
+	if (pixels * (mIs15Bit ? 2 : getComponents()) > getDataSize() - (S32)mDataOffset)
+	{ //here we have situation when data size in src less than actually needed
+		return FALSE;
+	}
 
 	if (getComponents() == 4)
 	{

indra/llimage/llimageworker.cpp

@@ -35,18 +35,20 @@
 LLImageDecodeThread::LLImageDecodeThread(bool threaded)
 	: LLQueuedThread("imagedecode", threaded)
 {
+	mCreationMutex = new LLMutex();
 }
 
 //virtual 
 LLImageDecodeThread::~LLImageDecodeThread()
 {
+	delete mCreationMutex ;
 }
 
 // MAIN THREAD
 // virtual
 S32 LLImageDecodeThread::update(F32 max_time_ms)
 {
-	LLMutexLock lock(&mCreationMutex);
+	LLMutexLock lock(mCreationMutex);
 	for (creation_list_t::iterator iter = mCreationList.begin();
 		 iter != mCreationList.end(); ++iter)
 	{
@@ -69,7 +71,7 @@ S32 LLImageDecodeThread::update(F32 max_time_ms)
 LLImageDecodeThread::handle_t LLImageDecodeThread::decodeImage(LLImageFormatted* image, 
 	U32 priority, S32 discard, BOOL needs_aux, Responder* responder)
 {
-	LLMutexLock lock(&mCreationMutex);
+	LLMutexLock lock(mCreationMutex);
 	handle_t handle = generateHandle();
 	mCreationList.push_back(creation_info(handle, image, priority, discard, needs_aux, responder));
 	return handle;
@@ -79,7 +81,7 @@ LLImageDecodeThread::handle_t LLImageDecodeThread::decodeImage(LLImageFormatted*
 // Returns the size of the mutex guarded list as an indication of sanity
 S32 LLImageDecodeThread::tut_size()
 {
-	LLMutexLock lock(&mCreationMutex);
+	LLMutexLock lock(mCreationMutex);
 	S32 res = mCreationList.size();
 	return res;
 }

indra/llimage/llimageworker.h

@@ -98,7 +98,7 @@ class LLImageDecodeThread : public LLQueuedThread
 	};
 	typedef std::list<creation_info> creation_list_t;
 	creation_list_t mCreationList;
-	LLMutex mCreationMutex;
+	LLMutex* mCreationMutex;
 };
 
 #endif

indra/llimage/llpngwrapper.h

@@ -26,16 +26,7 @@
 #ifndef LL_LLPNGWRAPPER_H
 #define LL_LLPNGWRAPPER_H
 
-#if LL_STANDALONE || (LL_LINUX && defined(__x86_64__))
-#include <png.h>
-#else
-// Workaround for wrongly packaged prebuilt.
-#if _MSC_VER >= 1800
-#include <libpng16/png.h>
-#else
-#include "libpng15/png.h"
-#endif
-#endif
+#include "png.h"
 #include "llimage.h"
 
 class LLPngWrapper