minetest
/
irrlicht
mirror of https://github.com/minetest/irrlicht.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix crash caused by memory overwriting in TGA loader caused by bad RLE data 

From sfan5's fuzzing test reported in Minetest here: https://github.com/minetest/irrlicht/issues/236
Was missing test if it writes beyond allocated memory which can be triggered by TGA's which lie in their RLE data.

git-svn-id: svn://svn.code.sf.net/p/irrlicht/code/trunk@6534 dfc29bdd-3216-0410-991c-e03cc46cb475
This commit is contained in:
cutealien 2023-09-23 18:33:46 +00:00 committed by sfan5
parent f53af0f2cf
commit 565f14677c
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
source/Irrlicht/CImageLoaderTGA.cpp
View File

@ -62,8 +62,13 @@ u8 *CImageLoaderTGA::loadCompressedImage(io::IReadFile *file, const STGAHeader&
for(s32 counter = 1; counter < chunkheader; counter++)
{
for(s32 elementCounter=0; elementCounter < bytesPerPixel; elementCounter++)
data[currentByte + elementCounter] = data[dataOffset + elementCounter];
if ( currentByte + bytesPerPixel <= imageSize )
{
for(s32 elementCounter=0; elementCounter < bytesPerPixel; elementCounter++)
{
data[currentByte + elementCounter] = data[dataOffset + elementCounter];
}
}
currentByte += bytesPerPixel;
}