mirror
/
OpenTTD
mirror of https://github.com/OpenTTD/OpenTTD
1
0
Fork 0
Code Issues

(svn r22871) -Fix [FS#4746]: Perform stricter checks on RLE compressed BMP images. (monoid)

release/1.2
michi_cc 2011-09-02 20:16:23 +00:00
parent be818a5f95
commit 73624abd5e
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/bmp.cpp
View File

@ -143,6 +143,7 @@ static inline bool BmpRead4Rle(BmpBuffer *buffer, BmpInfo *info, BmpData *data)
switch (c) { switch (c) {
case 0: // end of line case 0: // end of line
x = 0; x = 0;
if (y == 0) return false;
pixel = &data->bitmap[--y * info->width]; pixel = &data->bitmap[--y * info->width];
break; break;
case 1: // end of bitmap case 1: // end of bitmap
@ -153,7 +154,7 @@ static inline bool BmpRead4Rle(BmpBuffer *buffer, BmpInfo *info, BmpData *data)
case 2: // delta case 2: // delta
x += ReadByte(buffer); x += ReadByte(buffer);
i = ReadByte(buffer); i = ReadByte(buffer);
if (x >= info->width || (y == 0 && i > 0)) return false; if (x >= info->width || i > y) return false;
y -= i; y -= i;
pixel = &data->bitmap[y * info->width + x]; pixel = &data->bitmap[y * info->width + x];
break; break;
@ -226,6 +227,7 @@ static inline bool BmpRead8Rle(BmpBuffer *buffer, BmpInfo *info, BmpData *data)
switch (c) { switch (c) {
case 0: // end of line case 0: // end of line
x = 0; x = 0;
if (y == 0) return false;
pixel = &data->bitmap[--y * info->width]; pixel = &data->bitmap[--y * info->width];
break; break;
case 1: // end of bitmap case 1: // end of bitmap
@ -236,13 +238,16 @@ static inline bool BmpRead8Rle(BmpBuffer *buffer, BmpInfo *info, BmpData *data)
case 2: // delta case 2: // delta
x += ReadByte(buffer); x += ReadByte(buffer);
i = ReadByte(buffer); i = ReadByte(buffer);
if (x >= info->width || (y == 0 && i > 0)) return false; if (x >= info->width || i > y) return false;
y -= i; y -= i;
pixel = &data->bitmap[y * info->width + x]; pixel = &data->bitmap[y * info->width + x];
break; break;
default: // uncompressed default: // uncompressed
if ((x += c) > info->width) return false; for (i = 0; i < c; i++) {
for (i = 0; i < c; i++) *pixel++ = ReadByte(buffer); if (EndOfBuffer(buffer) || x >= info->width) return false;
*pixel++ = ReadByte(buffer);
x++;
}
/* Padding for 16 bit align */ /* Padding for 16 bit align */
SkipBytes(buffer, c % 2); SkipBytes(buffer, c % 2);
break; break;