From: divverent <divverent@d7cf8633-e32d-0410-b094-e92efae38249>
Date: Wed, 30 Dec 2009 07:38:47 +0000 (+0000)
Subject: DDS: handle file size errors
X-Git-Tag: xonotic-v0.1.0preview~912
X-Git-Url: https://git.rm.cloudns.org/?a=commitdiff_plain;h=849097d798188b45bbcf54b3253494a79b52a530;p=xonotic%2Fdarkplaces.git

DDS: handle file size errors


git-svn-id: svn://svn.icculus.org/twilight/trunk/darkplaces@9736 d7cf8633-e32d-0410-b094-e92efae38249
---

diff --git a/gl_textures.c b/gl_textures.c
index 3bd9bd1a..25107d6f 100644
--- a/gl_textures.c
+++ b/gl_textures.c
@@ -1225,6 +1225,12 @@ rtexture_t *R_LoadTextureDDSFile(rtexturepool_t *rtexturepool, const char *filen
 		bytesperblock = 0;
 		bytesperpixel = 4;
 		size = dds_width*dds_height*bytesperpixel;
+		if(128 + size < ddsfilesize)
+		{
+			Mem_Free(dds);
+			Con_Printf("^1%s: invalid BGRA DDS image\n");
+			return NULL;
+		}
 		// check alpha
 		for (i = 3;i < size;i += 4)
 			if (ddspixels[i] < 255)
@@ -1241,6 +1247,12 @@ rtexture_t *R_LoadTextureDDSFile(rtexturepool_t *rtexturepool, const char *filen
 		bytesperblock = 8;
 		bytesperpixel = 0;
 		size = ((dds_width+3)/4)*((dds_height+3)/4)*bytesperblock;
+		if(128 + size < ddsfilesize)
+		{
+			Mem_Free(dds);
+			Con_Printf("^1%s: invalid DXT1 DDS image\n");
+			return NULL;
+		}
 		for (i = 0;i < size;i += bytesperblock)
 			if (ddspixels[i+0] + ddspixels[i+1] * 256 <= ddspixels[i+2] + ddspixels[i+3] * 256)
 				break;
@@ -1256,6 +1268,12 @@ rtexture_t *R_LoadTextureDDSFile(rtexturepool_t *rtexturepool, const char *filen
 		bytesperblock = 16;
 		bytesperpixel = 0;
 		size = ((dds_width+3)/4)*((dds_height+3)/4)*bytesperblock;
+		if(128 + size < ddsfilesize)
+		{
+			Mem_Free(dds);
+			Con_Printf("^1%s: invalid DXT3 DDS image\n");
+			return NULL;
+		}
 		flags |= TEXF_ALPHA;
 	}
 	else if (!memcmp(dds+84, "DXT5", 4))
@@ -1264,6 +1282,12 @@ rtexture_t *R_LoadTextureDDSFile(rtexturepool_t *rtexturepool, const char *filen
 		bytesperblock = 16;
 		bytesperpixel = 0;
 		size = ((dds_width+3)/4)*((dds_height+3)/4)*bytesperblock;
+		if(128 + size < ddsfilesize)
+		{
+			Mem_Free(dds);
+			Con_Printf("^1%s: invalid DXT5 DDS image\n");
+			return NULL;
+		}
 		flags |= TEXF_ALPHA;
 	}
 	else