DDS: handle file size errors

git-svn-id: svn://svn.icculus.org/twilight/trunk/darkplaces@9736 d7cf8633-e32d-0410-b094-e92efae38249

diff --git a/gl_textures.c b/gl_textures.c
index 3bd9bd1af0242ec7f9c7369b037830b8805227fc..25107d6f5d05a243f8c3d9e1379bde9fa9971ce1 100644 (file)
--- a/gl_textures.c
+++ b/gl_textures.c
@@ -1225,6 +1225,12 @@ rtexture_t *R_LoadTextureDDSFile(rtexturepool_t *rtexturepool, const char *filen
                bytesperblock = 0;
                bytesperpixel = 4;
                size = dds_width*dds_height*bytesperpixel;
+               if(128 + size < ddsfilesize)
+               {
+                       Mem_Free(dds);
+                       Con_Printf("^1%s: invalid BGRA DDS image\n");
+                       return NULL;
+               }
                // check alpha
                for (i = 3;i < size;i += 4)
                        if (ddspixels[i] < 255)
@@ -1241,6 +1247,12 @@ rtexture_t *R_LoadTextureDDSFile(rtexturepool_t *rtexturepool, const char *filen
                bytesperblock = 8;
                bytesperpixel = 0;
                size = ((dds_width+3)/4)*((dds_height+3)/4)*bytesperblock;
+               if(128 + size < ddsfilesize)
+               {
+                       Mem_Free(dds);
+                       Con_Printf("^1%s: invalid DXT1 DDS image\n");
+                       return NULL;
+               }
                for (i = 0;i < size;i += bytesperblock)
                        if (ddspixels[i+0] + ddspixels[i+1] * 256 <= ddspixels[i+2] + ddspixels[i+3] * 256)
                                break;
@@ -1256,6 +1268,12 @@ rtexture_t *R_LoadTextureDDSFile(rtexturepool_t *rtexturepool, const char *filen
                bytesperblock = 16;
                bytesperpixel = 0;
                size = ((dds_width+3)/4)*((dds_height+3)/4)*bytesperblock;
+               if(128 + size < ddsfilesize)
+               {
+                       Mem_Free(dds);
+                       Con_Printf("^1%s: invalid DXT3 DDS image\n");
+                       return NULL;
+               }
                flags |= TEXF_ALPHA;
        }
        else if (!memcmp(dds+84, "DXT5", 4))
@@ -1264,6 +1282,12 @@ rtexture_t *R_LoadTextureDDSFile(rtexturepool_t *rtexturepool, const char *filen
                bytesperblock = 16;
                bytesperpixel = 0;
                size = ((dds_width+3)/4)*((dds_height+3)/4)*bytesperblock;
+               if(128 + size < ddsfilesize)
+               {
+                       Mem_Free(dds);
+                       Con_Printf("^1%s: invalid DXT5 DDS image\n");
+                       return NULL;
+               }
                flags |= TEXF_ALPHA;
        }
        else