39 lines
1.5 KiB
Diff
39 lines
1.5 KiB
Diff
From 20f77a9b7f53624014e8c7224eeb182674111bcb Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Jaroslav=20Loba=C4=8Devski?= <jarlob@github.com>
|
|
Date: Thu, 19 Oct 2023 16:10:45 +0200
|
|
Subject: [PATCH] Fix disclosure of uninitialized memory in stbi__tga_load
|
|
|
|
Fixes #1542
|
|
---
|
|
stb_image.h | 10 ++++++++--
|
|
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/stb_image.h b/stb_image.h
|
|
index 5e807a0a6..7db6dd3df 100644
|
|
--- a/stb_image.h
|
|
+++ b/stb_image.h
|
|
@@ -5933,7 +5933,10 @@ static void *stbi__tga_load(stbi__context *s, int *x, int *y, int *comp, int req
|
|
for (i=0; i < tga_height; ++i) {
|
|
int row = tga_inverted ? tga_height -i - 1 : i;
|
|
stbi_uc *tga_row = tga_data + row*tga_width*tga_comp;
|
|
- stbi__getn(s, tga_row, tga_width * tga_comp);
|
|
+ if(!stbi__getn(s, tga_row, tga_width * tga_comp)) {
|
|
+ STBI_FREE(tga_data);
|
|
+ return stbi__errpuc("bad palette", "Corrupt TGA");
|
|
+ }
|
|
}
|
|
} else {
|
|
// do I need to load a palette?
|
|
@@ -7218,7 +7221,10 @@ static float *stbi__hdr_load(stbi__context *s, int *x, int *y, int *comp, int re
|
|
for (i=0; i < width; ++i) {
|
|
stbi_uc rgbe[4];
|
|
main_decode_loop:
|
|
- stbi__getn(s, rgbe, 4);
|
|
+ if (!stbi__getn(s, rgbe, 4)) {
|
|
+ STBI_FREE(hdr_data);
|
|
+ return stbi__errpf("invalid decoded scanline length", "corrupt HDR");
|
|
+ }
|
|
stbi__hdr_convert(hdr_data + j * width * req_comp + i * req_comp, rgbe, req_comp);
|
|
}
|
|
}
|