Add some validation for gfx.wad.

Quake/gl_draw.c

@@ -221,6 +221,7 @@ qpic_t *Draw_PicFromWad (const char *name)
 	qpic_t	*p;
 	glpic_t	gl;
 	src_offset_t offset; //johnfitz
+	lumpinfo_t *info;
 
 	//Spike -- added cachepic stuff here, to avoid glitches if the function is called multiple times with the same image.
 	for (pic=menu_cachepics, i=0 ; i<menu_numcachepics ; pic++, i++)
@@ -231,8 +232,14 @@ qpic_t *Draw_PicFromWad (const char *name)
 	if (menu_numcachepics == MAX_CACHED_PICS)
 		Sys_Error ("menu_numcachepics == MAX_CACHED_PICS");
 
-	p = (qpic_t *) W_GetLumpName (name);
+	p = (qpic_t *) W_GetLumpName (name, &info);
-	if (!p) return pic_nul; //johnfitz
+	if (!p)
+	{
+		Con_SafePrintf ("W_GetLumpName: %s not found\n", name);
+		return pic_nul; //johnfitz
+	}
+	if (info->size < sizeof(int)*2 || 8+p->width*p->height < info->size) Sys_Error ("Draw_PicFromWad: pic \"%s\" truncated", name);
+	if (info->type != TYP_QPIC) Sys_Error ("Draw_PicFromWad: lump \"%s\" is not a qpic", name);
 
 	// load little ones into the scrap
 	if (p->width < 64 && p->height < 64)
@@ -408,9 +415,12 @@ void Draw_LoadPics (void)
 {
 	byte		*data;
 	src_offset_t	offset;
+	lumpinfo_t *info;
 
-	data = (byte *) W_GetLumpName ("conchars");
+	data = (byte *) W_GetLumpName ("conchars", &info);
-	if (!data) Sys_Error ("Draw_LoadPics: couldn't load conchars");
+	if (!data || info->size < 128*128)	Sys_Error ("Draw_LoadPics: couldn't load conchars");
+	if (info->size != 128*128)			Con_Warning("Invalid size for gfx.wad conchars lump - attempting to ignore for compat.\n");
+	else if (info->type != TYP_MIPTEX)	Con_DWarning("Invalid type for gfx.wad conchars lump - attempting to ignore for compat.\n"); //not really a miptex, but certainly NOT a qpic.
 	offset = (src_offset_t)data - (src_offset_t)wad_base;
 	char_texture = TexMgr_LoadImage (NULL, WADFILENAME":conchars", 128, 128, SRC_INDEXED, data,
 		WADFILENAME, offset, (premul_hud?TEXPREF_PREMULTIPLY:0)|TEXPREF_ALPHA | TEXPREF_NEAREST | TEXPREF_NOPICMIP | TEXPREF_CONCHARS);

Quake/sbar.c

@@ -116,9 +116,10 @@ qpic_t *Sbar_CheckPicFromWad (const char *name)
 {
 	extern qpic_t *pic_nul;
 	qpic_t *r;
+	lumpinfo_t *info;
 	if (!hudtype)
 		return pic_nul;	//one already failed, don't waste cpu
-	if (!W_GetLumpinfo(name))
+	if (!W_GetLumpName(name, &info))
 		r = pic_nul;
 	else
 		r = Draw_PicFromWad(name);

Quake/wad.c

@@ -40,7 +40,7 @@ Space padding is so names can be printed nicely in tables.
 Can safely be performed in place.
 ==================
 */
-void W_CleanupName (const char *in, char *out)
+static void W_CleanupName (const char *in, char *out)
 {
 	int		i;
 	int		c;
@@ -94,12 +94,16 @@ void W_LoadWadFile (void) //johnfitz -- filename is now hard-coded for honesty
 	wad_numlumps = LittleLong(header->numlumps);
 	infotableofs = LittleLong(header->infotableofs);
 	wad_lumps = (lumpinfo_t *)(wad_base + infotableofs);
+	if (infotableofs < 0 || infotableofs+wad_numlumps*sizeof(lumpinfo_t)>com_filesize)
+		Sys_Error ("Wad file %s header extends beyond end of file\n",filename);
 
 	for (i=0, lump_p = wad_lumps ; i<wad_numlumps ; i++,lump_p++)
 	{
 		lump_p->filepos = LittleLong(lump_p->filepos);
 		lump_p->size = LittleLong(lump_p->size);
-		W_CleanupName (lump_p->name, lump_p->name);	// CAUTION: in-place editing!!!
+		if (lump_p->filepos < 0 || lump_p->size < 0 || lump_p->filepos + lump_p->size > com_filesize)
+			Sys_Error ("Wad file %s lump \"%16s\" extends beyond end of file\n",filename, lump_p->name);
+		W_CleanupName (lump_p->name, lump_p->name);	// CAUTION: in-place editing!!! The endian fixups too.
 		if (lump_p->type == TYP_QPIC)
 			SwapPic ( (qpic_t *)(wad_base + lump_p->filepos));
 	}
@@ -111,7 +115,7 @@ void W_LoadWadFile (void) //johnfitz -- filename is now hard-coded for honesty
 W_GetLumpinfo
 =============
 */
-lumpinfo_t	*W_GetLumpinfo (const char *name)
+static lumpinfo_t	*W_GetLumpinfo (const char *name)
 {
 	int		i;
 	lumpinfo_t	*lump_p;
@@ -128,30 +132,16 @@ lumpinfo_t	*W_GetLumpinfo (const char *name)
 	return NULL;
 }
 
-void *W_GetLumpName (const char *name)
+void *W_GetLumpName (const char *name, lumpinfo_t **out_info)	//Spike: so caller can verify that the qpic was written properly.
 {
 	lumpinfo_t	*lump;
 
 	lump = W_GetLumpinfo (name);
 
 	if (!lump)
-	{
-		Con_SafePrintf ("W_GetLumpName: %s not found\n", name); //johnfitz -- was Sys_Error
 		return NULL; //johnfitz
-	}
-
-	return (void *)(wad_base + lump->filepos);
-}
-
-void *W_GetLumpNum (int num)
-{
-	lumpinfo_t	*lump;
-
-	if (num < 0 || num > wad_numlumps)
-		Sys_Error ("W_GetLumpNum: bad number: %i", num);
-
-	lump = wad_lumps + num;
 
+	*out_info = lump;
 	return (void *)(wad_base + lump->filepos);
 }
 

Quake/wad.h

@@ -71,10 +71,7 @@ extern	lumpinfo_t	*wad_lumps;
 extern	byte		*wad_base;
 
 void	W_LoadWadFile (void); //johnfitz -- filename is now hard-coded for honesty
-void	W_CleanupName (const char *in, char *out);
+void	*W_GetLumpName (const char *name, lumpinfo_t **out_info);
-lumpinfo_t	*W_GetLumpinfo (const char *name);
-void	*W_GetLumpName (const char *name);
-void	*W_GetLumpNum (int num);
 
 void SwapPic (qpic_t *pic);