Fixed TALOS-2019-0821, reading invalid data from the file when bpl is -1

libsdl-org · Jun 10, 2019 · 802a9ec · 802a9ec
1 parent 782d29a
commit 802a9ec
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/IMG_pcx.c b/IMG_pcx.c
@@ -160,7 +160,7 @@ SDL_Surface *IMG_LoadPCX_RW(SDL_RWops *src)
         goto done;
 
     bpl = pcxh.NPlanes * pcxh.BytesPerLine;
-    if ( bpl > surface->pitch ) {
+    if ( bpl < 0 || bpl > surface->pitch ) {
         error = "bytes per line is too large (corrupt?)";
         goto done;
     }