fte/quakespasm
2
0
Fork 0
mirror of https://github.com/Shpoike/Quakespasm.git synced 2024-11-10 07:21:58 +00:00
Code Issues Projects Releases Packages Wiki Activity

gl_model.c: Mod_LoadTextures: avoid crash on broken maps such as jam2_tronyn.bsp or kellbase1.bsp, where we try to read texture pixel data past the end of the texture lump (crashing because the textue lump is the last thing in the .bsp file buffer).

Browse source 
This would only hapen on OS X or Linux (perhaps just luck or windows is more leniant about reading ~40 bytes past the end of a malloc). Note this will only handle cases where the lump size is recorded as being too small, we will still crash if the bsp file itself is truncated since there are generally no checks against the whole .bsp file buffer size.

FYI, the corruption in jam2_tronyn.bsp was caused by a bug in tyrutils which is fixed now: http://disenchant.net/git/?p=tyrutils&a=commit&h=5111c5485c96918b937843715f9b8f51f263e40e
Not sure about kellbase1.bsp (quoth).

git-svn-id: svn+ssh://svn.code.sf.net/p/quakespasm/code/trunk@1228 af15c1b1-3010-417e-b628-4374ebc0bcbd
This commit is contained in:
ewasylishen 2015-06-12 02:26:10 +00:00
parent 76b1206f7d
commit aca6afe940
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
quakespasm/Quake/gl_model.c
View file

@ -442,6 +442,16 @@ void Mod_LoadTextures (lump_t *l)
for (j=0 ; j<MIPLEVELS ; j++) for (j=0 ; j<MIPLEVELS ; j++)
tx->offsets[j] = mt->offsets[j] + sizeof(texture_t) - sizeof(miptex_t); tx->offsets[j] = mt->offsets[j] + sizeof(texture_t) - sizeof(miptex_t);
// the pixels immediately follow the structures // the pixels immediately follow the structures
// ericw -- check for pixels extending past the end of the lump.
// appears in the wild; e.g. jam2_tronyn.bsp (func_mapjam2),
// kellbase1.bsp (quoth), and can lead to a segfault if we read past
// the end of the .bsp file buffer
if (((byte*)(mt+1) + pixels) > (mod_base + l->fileofs + l->filelen))
{
Con_DPrintf("Texture %s extends past end of lump\n", mt->name);
pixels = q_max(0, (mod_base + l->fileofs + l->filelen) - (byte*)(mt+1));
}
memcpy ( tx+1, mt+1, pixels); memcpy ( tx+1, mt+1, pixels);
tx->update_warp = false; //johnfitz tx->update_warp = false; //johnfitz