From 0c3c6345e9e7eb6e69de098683ee05d886b9e99b Mon Sep 17 00:00:00 2001 From: veygax Date: Fri, 14 Nov 2025 22:44:23 +0000 Subject: [PATCH] engine: imagelib: fix pixel iteration bounds checking on 1-bit BMPs move 1-bit BMP bounds checking to the beginning of a loop to prevent a second iteration Fixes: [GHSA-3p7j-2339-g5mm](https://github.com/FWGS/xash3d-fwgs/security/advisories/GHSA-3p7j-2339-g5mm) Signed-off-by: veygax --- engine/common/imagelib/img_bmp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/engine/common/imagelib/img_bmp.c b/engine/common/imagelib/img_bmp.c index 07eb473b..a3cb45f6 100644 --- a/engine/common/imagelib/img_bmp.c +++ b/engine/common/imagelib/img_bmp.c @@ -219,13 +219,13 @@ qboolean Image_LoadBMP( const char *name, const byte *buffer, fs_offset_t filesi column--; // ingnore main iterations for( c = 0, k = 128; c < 8; c++, k >>= 1 ) { + if( ++column >= columns ) + break; red = green = blue = (!!(alpha & k) == 1 ? 0xFF : 0x00); *pixbuf++ = red; *pixbuf++ = green; *pixbuf++ = blue; *pixbuf++ = 0x00; - if( ++column == columns ) - break; } break; case 4: