Blame SDL_image-IMG_lbm.patch
|
 |
75e80cb |
--- trunk/SDL_image/IMG_lbm.c 2007/07/20 04:37:11 3341
|
|
|
75e80cb |
+++ trunk/SDL_image/IMG_lbm.c 2008/01/03 20:05:34 3521
|
|
|
75e80cb |
@@ -28,6 +28,7 @@
|
|
|
75e80cb |
EHB and HAM (specific Amiga graphic chip modes) support added by Marc Le Douarain
|
|
|
75e80cb |
(http://www.multimania.com/mavati) in December 2003.
|
|
|
75e80cb |
Stencil and colorkey fixes by David Raulo (david.raulo AT free DOT fr) in February 2004.
|
|
|
75e80cb |
+ Buffer overflow fix in RLE decompression by David Raulo in January 2008.
|
|
|
75e80cb |
*/
|
|
|
75e80cb |
|
|
|
75e80cb |
#include <stdio.h>
|
|
|
75e80cb |
@@ -328,7 +329,7 @@
|
|
|
75e80cb |
count ^= 0xFF;
|
|
|
75e80cb |
count += 2; /* now it */
|
|
|
75e80cb |
|
|
|
75e80cb |
- if ( !SDL_RWread( src, &color, 1, 1 ) )
|
|
|
75e80cb |
+ if ( ( count > remainingbytes ) || !SDL_RWread( src, &color, 1, 1 ) )
|
|
|
75e80cb |
{
|
|
|
75e80cb |
error="error reading BODY chunk";
|
|
|
75e80cb |
goto done;
|
|
|
75e80cb |
@@ -339,7 +340,7 @@
|
|
|
75e80cb |
{
|
|
|
75e80cb |
++count;
|
|
|
75e80cb |
|
|
|
75e80cb |
- if ( !SDL_RWread( src, ptr, count, 1 ) )
|
|
|
75e80cb |
+ if ( ( count > remainingbytes ) || !SDL_RWread( src, ptr, count, 1 ) )
|
|
|
75e80cb |
{
|
|
|
75e80cb |
error="error reading BODY chunk";
|
|
|
75e80cb |
goto done;
|