Mercurial > hg > openttd
changeset 18056:fec137cbf409 draft
(svn r22871) -Fix [FS#4746]: Perform stricter checks on RLE compressed BMP images. (monoid)
author | michi_cc <michi_cc@openttd.org> |
---|---|
date | Fri, 02 Sep 2011 20:16:23 +0000 |
parents | 21aee1b2fc81 |
children | bd430caf5a36 |
files | src/bmp.cpp |
diffstat | 1 files changed, 9 insertions(+), 4 deletions(-) [+] |
line wrap: on
line diff
--- a/src/bmp.cpp +++ b/src/bmp.cpp @@ -143,6 +143,7 @@ switch (c) { case 0: // end of line x = 0; + if (y == 0) return false; pixel = &data->bitmap[--y * info->width]; break; case 1: // end of bitmap @@ -153,7 +154,7 @@ case 2: // delta x += ReadByte(buffer); i = ReadByte(buffer); - if (x >= info->width || (y == 0 && i > 0)) return false; + if (x >= info->width || i > y) return false; y -= i; pixel = &data->bitmap[y * info->width + x]; break; @@ -226,6 +227,7 @@ switch (c) { case 0: // end of line x = 0; + if (y == 0) return false; pixel = &data->bitmap[--y * info->width]; break; case 1: // end of bitmap @@ -236,13 +238,16 @@ case 2: // delta x += ReadByte(buffer); i = ReadByte(buffer); - if (x >= info->width || (y == 0 && i > 0)) return false; + if (x >= info->width || i > y) return false; y -= i; pixel = &data->bitmap[y * info->width + x]; break; default: // uncompressed - if ((x += c) > info->width) return false; - for (i = 0; i < c; i++) *pixel++ = ReadByte(buffer); + for (i = 0; i < c; i++) { + if (EndOfBuffer(buffer) || x >= info->width) return false; + *pixel++ = ReadByte(buffer); + x++; + } /* Padding for 16 bit align */ SkipBytes(buffer, c % 2); break;