diff --git a/changes.txt b/changes.txt index ef49032..b66657a 100644 --- a/changes.txt +++ b/changes.txt @@ -1,6 +1,9 @@ -------------------------- Changes in 1.9 (not yet released) +- Fix number overflow in TGA loader causing crashes later on. Thanks @sfan5 for fuzzing test. +- Fix several buffer overflows in TGA loader. Thanks @erlehmann for report and @sfan5 for fuzzing test: https://github.com/minetest/irrlicht/issues/236 +- TGA loader no longer reduces 24&32 bit TGA's with palettes to 16 bit. Thanks @erlehmann for report: https://irrlicht.sourceforge.io/forum/viewtopic.php?t=52925 - Fix compile error with OS X 10.10 SDK, bug #463. Thanks @Ryan Schmidt for report and patch. - Optimize quaternion::rotationFromTo. Thanks @Robert Eisele for patch and proof (https://raw.org/proof/quaternion-from-two-vectors) - Shader material example shows now how to pass material values. diff --git a/source/Irrlicht/CImageLoaderTGA.cpp b/source/Irrlicht/CImageLoaderTGA.cpp index bb0814a..05ee4b9 100644 --- a/source/Irrlicht/CImageLoaderTGA.cpp +++ b/source/Irrlicht/CImageLoaderTGA.cpp @@ -163,7 +163,7 @@ IImage* CImageLoaderTGA::loadImage(io::IReadFile* file) const header.ImageType == 3 // Uncompressed, black and white images ) { - const s32 imageSize = header.ImageHeight * header.ImageWidth * header.PixelDepth/8; + const s32 imageSize = header.ImageHeight * header.ImageWidth * (header.PixelDepth/8); data = new u8[imageSize]; file->read(data, imageSize); }