RomkaZVO/xash3d-fwgs
1
0
Fork 0
mirror of https://github.com/FWGS/xash3d-fwgs.git synced 2026-08-05 03:24:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

engine: imagelib: fix buffer overflow when the amount of colors in palette reported by BMP header are higher than 256

Browse Source 
Thanks to @veygax for report!
This commit is contained in:
Alibek Omarov
2025-10-30 17:27:56 +05:00
parent f22a50b680
commit 21ea83027e
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
engine/common/imagelib/img_bmp.c
View File

@@ -102,7 +102,15 @@ qboolean Image_LoadBMP( const char *name, const byte *buffer, fs_offset_t filesi
bhdr.colors = 256;
cbPalBytes = ( 1 << bhdr.bitsPerPixel ) * sizeof( rgba_t );
}
else cbPalBytes = bhdr.colors * sizeof( rgba_t );
else
{
if( bhdr.colors > 256 )
{
Con_DPrintf( S_WARN "%s: %s palette have too many colors (%u), clamping to 256\n", __func__, name, bhdr.colors );
bhdr.colors = 256;
}
cbPalBytes = bhdr.colors * sizeof( rgba_t );
}
}
estimatedSize = ( buf_p - buffer ) + cbPalBytes;