Lines 1-28
Link Here
|
1 |
--- IMG_lbm.c 2007/07/20 04:37:11 3341 |
|
|
2 |
+++ IMG_lbm.c 2008/01/03 20:05:34 3521 |
3 |
@@ -28,6 +28,7 @@ |
4 |
EHB and HAM (specific Amiga graphic chip modes) support added by Marc Le Douarain |
5 |
(http://www.multimania.com/mavati) in December 2003. |
6 |
Stencil and colorkey fixes by David Raulo (david.raulo AT free DOT fr) in February 2004. |
7 |
+ Buffer overflow fix in RLE decompression by David Raulo in January 2008. |
8 |
*/ |
9 |
|
10 |
#include <stdio.h> |
11 |
@@ -328,7 +329,7 @@ |
12 |
count ^= 0xFF; |
13 |
count += 2; /* now it */ |
14 |
|
15 |
- if ( !SDL_RWread( src, &color, 1, 1 ) ) |
16 |
+ if ( ( count > remainingbytes ) || !SDL_RWread( src, &color, 1, 1 ) ) |
17 |
{ |
18 |
error="error reading BODY chunk"; |
19 |
goto done; |
20 |
@@ -339,7 +340,7 @@ |
21 |
{ |
22 |
++count; |
23 |
|
24 |
- if ( !SDL_RWread( src, ptr, count, 1 ) ) |
25 |
+ if ( ( count > remainingbytes ) || !SDL_RWread( src, ptr, count, 1 ) ) |
26 |
{ |
27 |
error="error reading BODY chunk"; |
28 |
goto done; |