BRNSystems/irrlicht
1
0
Fork 0
forked from Mirrorlandia_minetest/irrlicht
Code Pull Requests Activity

Fix crash caused by memory overwriting in TGA loader caused by bad RLE data

Browse Source 
From sfan5's fuzzing test reported in Minetest here: https://github.com/minetest/irrlicht/issues/236
Was missing test if it writes beyond allocated memory which can be triggered by TGA's which lie in their RLE data.

git-svn-id: svn://svn.code.sf.net/p/irrlicht/code/trunk@6534 dfc29bdd-3216-0410-991c-e03cc46cb475
This commit is contained in:
cutealien 2023-09-23 18:33:46 +00:00 committed by sfan5
parent f53af0f2cf
commit 565f14677c
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
source/Irrlicht/CImageLoaderTGA.cpp
View File

@ -62,8 +62,13 @@ u8 *CImageLoaderTGA::loadCompressedImage(io::IReadFile *file, const STGAHeader&
for(s32 counter = 1; counter < chunkheader; counter++)
{
for(s32 elementCounter=0; elementCounter < bytesPerPixel; elementCounter++)
data[currentByte + elementCounter] = data[dataOffset + elementCounter];
if ( currentByte + bytesPerPixel <= imageSize )
{
for(s32 elementCounter=0; elementCounter < bytesPerPixel; elementCounter++)
{
data[currentByte + elementCounter] = data[dataOffset + elementCounter];
}
}
currentByte += bytesPerPixel;
}