Fixed buffer overflow in BMP loading code, discovered by j00ru//vx
authorSam Lantinga <slouken@libsdl.org>
Sun, 02 Nov 2008 23:13:00 +0000
changeset 184578a70f2c6d7
parent 183 efaf6dd65e0a
child 185 6b749dde323b
Fixed buffer overflow in BMP loading code, discovered by j00ru//vx
CHANGES
IMG_bmp.c
     1.1 --- a/CHANGES	Thu Jan 03 20:05:34 2008 +0000
     1.2 +++ b/CHANGES	Sun Nov 02 23:13:00 2008 +0000
     1.3 @@ -1,4 +1,6 @@
     1.4  1.2.7:
     1.5 +Sam Lantinga - Sun Nov  2 15:08:27 PST 2008
     1.6 + * Fixed buffer overflow in BMP loading code, discovered by j00ru//vx
     1.7  Sam Lantinga - Fri Dec 28 08:34:54 PST 2007
     1.8   * Fixed buffer overflow in GIF loading code, discovered by Michael Skladnikiewicz
     1.9  
     2.1 --- a/IMG_bmp.c	Thu Jan 03 20:05:34 2008 +0000
     2.2 +++ b/IMG_bmp.c	Sun Nov 02 23:13:00 2008 +0000
     2.3 @@ -68,11 +68,15 @@
     2.4  	*/
     2.5  	int pitch = surface->pitch;
     2.6  	int height = surface->h;
     2.7 -	Uint8 * bits = (Uint8 *)surface->pixels + ((height-1) * pitch);
     2.8 +	Uint8 *start = (Uint8 *)surface->pixels;
     2.9 +	Uint8 *end = start + (height*pitch);
    2.10 +	Uint8 *bits = end-pitch, *spot;
    2.11  	int ofs = 0;
    2.12  	Uint8 ch;
    2.13  	Uint8 needsPad;
    2.14  
    2.15 +#define COPY_PIXEL(x)	spot = &bits[ofs++]; if(spot >= start && spot < end) *spot = (x)
    2.16 +
    2.17  	for (;;) {
    2.18  		if ( !SDL_RWread(src, &ch, 1, 1) ) return 1;
    2.19  		/*
    2.20 @@ -84,15 +88,15 @@
    2.21  			if ( !SDL_RWread(src, &pixel, 1, 1) ) return 1;
    2.22  			if ( isRle8 ) {                 /* 256-color bitmap, compressed */
    2.23  				do {
    2.24 -					bits[ofs++] = pixel;
    2.25 +					COPY_PIXEL(pixel);
    2.26  				} while (--ch);
    2.27 -			}else {                         /* 16-color bitmap, compressed */
    2.28 +			} else {                         /* 16-color bitmap, compressed */
    2.29  				Uint8 pixel0 = pixel >> 4;
    2.30  				Uint8 pixel1 = pixel & 0x0F;
    2.31  				for (;;) {
    2.32 -					bits[ofs++] = pixel0;     /* even count, high nibble */
    2.33 +					COPY_PIXEL(pixel0);	/* even count, high nibble */
    2.34  					if (!--ch) break;
    2.35 -					bits[ofs++] = pixel1;     /* odd count, low nibble */
    2.36 +					COPY_PIXEL(pixel1);	/* odd count, low nibble */
    2.37  					if (!--ch) break;
    2.38  				}
    2.39  			}
    2.40 @@ -120,16 +124,18 @@
    2.41  				if (isRle8) {
    2.42  					needsPad = ( ch & 1 );
    2.43  					do {
    2.44 -						if ( !SDL_RWread(src, bits + ofs++, 1, 1) ) return 1;
    2.45 +						Uint8 pixel;
    2.46 +						if ( !SDL_RWread(src, &pixel, 1, 1) ) return 1;
    2.47 +						COPY_PIXEL(pixel);
    2.48  					} while (--ch);
    2.49  				} else {
    2.50  					needsPad = ( ((ch+1)>>1) & 1 ); /* (ch+1)>>1: bytes size */
    2.51  					for (;;) {
    2.52  						Uint8 pixel;
    2.53  						if ( !SDL_RWread(src, &pixel, 1, 1) ) return 1;
    2.54 -						bits[ofs++] = pixel >> 4;
    2.55 +						COPY_PIXEL(pixel >> 4);
    2.56  						if (!--ch) break;
    2.57 -						bits[ofs++] = pixel & 0x0F;
    2.58 +						COPY_PIXEL(pixel & 0x0F);
    2.59  						if (!--ch) break;
    2.60  					}
    2.61  				}