ubergames/lilium-voyager
0
0
Fork 0
mirror of https://github.com/UberGames/lilium-voyager.git synced 2024-11-10 14:41:42 +00:00
Code Issues Projects Releases Packages Wiki Activity

integer overflow safeguards

Browse source
This commit is contained in:
Ludwig Nussel 2008-02-12 10:03:43 +00:00
parent 4eec54c338
commit f65dbd4351
1 changed files with 14 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
code/renderer/tr_image_png.c
View file

@ -23,6 +23,11 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
#include "../qcommon/puff.h" #include "../qcommon/puff.h"
// we could limit the png size to a lower value here
#ifndef INT_MAX
#define INT_MAX 0x1fffffff
#endif
/* /*
================= =================
PNG LOADING PNG LOADING
@ -287,7 +292,7 @@ static void CloseBufferedFile(struct BufferedFile *BF)
* Get a pointer to the requested bytes. * Get a pointer to the requested bytes.
*/ */
static void *BufferedFileRead(struct BufferedFile *BF, int Length) static void *BufferedFileRead(struct BufferedFile *BF, unsigned Length)
{ {
void *RetVal; void *RetVal;
@ -329,9 +334,9 @@ static void *BufferedFileRead(struct BufferedFile *BF, int Length)
* Rewind the buffer. * Rewind the buffer.
*/ */
static qboolean BufferedFileRewind(struct BufferedFile *BF, int Offset) static qboolean BufferedFileRewind(struct BufferedFile *BF, unsigned Offset)
{ {
int BytesRead; unsigned BytesRead;
/* /*
* input verification * input verification
@ -346,7 +351,7 @@ static qboolean BufferedFileRewind(struct BufferedFile *BF, int Offset)
* special trick to rewind to the beginning of the buffer * special trick to rewind to the beginning of the buffer
*/ */
if(Offset == -1) if(Offset == (unsigned)-1)
{ {
BF->Ptr = BF->Buffer; BF->Ptr = BF->Buffer;
BF->BytesLeft = BF->Length; BF->BytesLeft = BF->Length;
@ -383,7 +388,7 @@ static qboolean BufferedFileRewind(struct BufferedFile *BF, int Offset)
* Skip some bytes. * Skip some bytes.
*/ */
static qboolean BufferedFileSkip(struct BufferedFile *BF, int Offset) static qboolean BufferedFileSkip(struct BufferedFile *BF, unsigned Offset)
{ {
/* /*
* input verification * input verification
@ -2041,10 +2046,13 @@ void LoadPNG(const char *name, byte **pic, int *width, int *height)
* Check if Width and Height are valid. * Check if Width and Height are valid.
*/ */
if(!((IHDR_Width > 0) && (IHDR_Height > 0))) if(!((IHDR_Width > 0) && (IHDR_Height > 0))
|| IHDR_Width > INT_MAX / Q3IMAGE_BYTESPERPIXEL / IHDR_Height)
{ {
CloseBufferedFile(ThePNG); CloseBufferedFile(ThePNG);
Com_Printf(S_COLOR_YELLOW "%s: invalid image size\n", name);
return; return;
} }