Line 0
Link Here
|
|
|
1 |
--- src/gd_tga.c.orig 2016-06-03 08:34:39 UTC |
2 |
+++ src/gd_tga.c |
3 |
@@ -99,7 +99,7 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFro |
4 |
if (tga->bits == TGA_BPP_24) { |
5 |
*tpix = gdTrueColor(tga->bitmap[bitmap_caret + 2], tga->bitmap[bitmap_caret + 1], tga->bitmap[bitmap_caret]); |
6 |
bitmap_caret += 3; |
7 |
- } else if (tga->bits == TGA_BPP_32 || tga->alphabits) { |
8 |
+ } else if (tga->bits == TGA_BPP_32 && tga->alphabits) { |
9 |
register int a = tga->bitmap[bitmap_caret + 3]; |
10 |
|
11 |
*tpix = gdTrueColorAlpha(tga->bitmap[bitmap_caret + 2], tga->bitmap[bitmap_caret + 1], tga->bitmap[bitmap_caret], gdAlphaMax - (a >> 1)); |
12 |
@@ -159,16 +159,13 @@ int read_header_tga(gdIOCtx *ctx, oTga * |
13 |
printf("wxh: %i %i\n", tga->width, tga->height); |
14 |
#endif |
15 |
|
16 |
- switch(tga->bits) { |
17 |
- case 8: |
18 |
- case 16: |
19 |
- case 24: |
20 |
- case 32: |
21 |
- break; |
22 |
- default: |
23 |
- gd_error("bps %i not supported", tga->bits); |
24 |
+ if (!((tga->bits == TGA_BPP_24 && tga->alphabits == 0) |
25 |
+ || (tga->bits == TGA_BPP_32 && tga->alphabits == 8))) |
26 |
+ { |
27 |
+ gd_error_ex(GD_WARNING, "gd-tga: %u bits per pixel with %u alpha bits not supported\n", |
28 |
+ tga->bits, tga->alphabits); |
29 |
+ |
30 |
return -1; |
31 |
- break; |
32 |
} |
33 |
|
34 |
tga->ident = NULL; |
35 |
@@ -273,14 +270,23 @@ int read_image_tga( gdIOCtx *ctx, oTga * |
36 |
buffer_caret = 0; |
37 |
|
38 |
while( bitmap_caret < image_block_size ) { |
39 |
- |
40 |
+ |
41 |
if ((decompression_buffer[buffer_caret] & TGA_RLE_FLAG) == TGA_RLE_FLAG) { |
42 |
encoded_pixels = ( ( decompression_buffer[ buffer_caret ] & 127 ) + 1 ); |
43 |
buffer_caret++; |
44 |
|
45 |
- for (i = 0; i < encoded_pixels; i++) { |
46 |
- for (j = 0; j < pixel_block_size; j++, bitmap_caret++) { |
47 |
- tga->bitmap[ bitmap_caret ] = decompression_buffer[ buffer_caret + j ]; |
48 |
+ if (encoded_pixels != 0) { |
49 |
+ |
50 |
+ if (!((buffer_caret + (encoded_pixels * pixel_block_size)) < image_block_size)) { |
51 |
+ gdFree( decompression_buffer ); |
52 |
+ gdFree( conversion_buffer ); |
53 |
+ return -1; |
54 |
+ } |
55 |
+ |
56 |
+ for (i = 0; i < encoded_pixels; i++) { |
57 |
+ for (j = 0; j < pixel_block_size; j++, bitmap_caret++) { |
58 |
+ tga->bitmap[ bitmap_caret ] = decompression_buffer[ buffer_caret + j ]; |
59 |
+ } |
60 |
} |
61 |
} |
62 |
buffer_caret += pixel_block_size; |
63 |
@@ -288,11 +294,20 @@ int read_image_tga( gdIOCtx *ctx, oTga * |
64 |
encoded_pixels = decompression_buffer[ buffer_caret ] + 1; |
65 |
buffer_caret++; |
66 |
|
67 |
- for (i = 0; i < encoded_pixels; i++) { |
68 |
- for( j = 0; j < pixel_block_size; j++, bitmap_caret++ ) { |
69 |
- tga->bitmap[ bitmap_caret ] = decompression_buffer[ buffer_caret + j ]; |
70 |
+ if (encoded_pixels != 0) { |
71 |
+ |
72 |
+ if (!((buffer_caret + (encoded_pixels * pixel_block_size)) < image_block_size)) { |
73 |
+ gdFree( decompression_buffer ); |
74 |
+ gdFree( conversion_buffer ); |
75 |
+ return -1; |
76 |
+ } |
77 |
+ |
78 |
+ for (i = 0; i < encoded_pixels; i++) { |
79 |
+ for( j = 0; j < pixel_block_size; j++, bitmap_caret++ ) { |
80 |
+ tga->bitmap[ bitmap_caret ] = decompression_buffer[ buffer_caret + j ]; |
81 |
+ } |
82 |
+ buffer_caret += pixel_block_size; |
83 |
} |
84 |
- buffer_caret += pixel_block_size; |
85 |
} |
86 |
} |
87 |
} |