bmp: don't overflow palette buffer with bogus biClrUsed values.

libsdl-org · Jan 24, 2018 · 071a199 · 071a199
1 parent da6a5c5
commit 071a199
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/IMG_bmp.c b/IMG_bmp.c
@@ -760,6 +760,11 @@ LoadICOCUR_RW(SDL_RWops * src, int type, int freesrc)
         if (biClrUsed == 0) {
             biClrUsed = 1 << biBitCount;
         }
+        if (biClrUsed > SDL_arraysize(palette)) {
+            IMG_SetError("Unsupported or incorrect biClrUsed field");
+            was_error = SDL_TRUE;
+            goto done;
+        }
         for (i = 0; i < (int) biClrUsed; ++i) {
             SDL_RWread(src, &palette[i], 4, 1);
         }