Fix loading RLE compressed TGA files.

Fix memory reads outside of input buffer when loading invalid TGA files.

2 files changed, 16 insertions, 10 deletions

diff --git a/modules/tga/image_loader_tga.cpp b/modules/tga/image_loader_tga.cpp
index 3cfd4ff36a..6eaa2d24a8 100644
--- a/modules/tga/image_loader_tga.cpp
+++ b/modules/tga/image_loader_tga.cpp
@@ -35,7 +35,7 @@
 #include "core/os/os.h"
 #include "core/string/print_string.h"
 
-Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t p_pixel_size, uint8_t *p_uncompressed_buffer, size_t p_output_size) {
+Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t p_pixel_size, uint8_t *p_uncompressed_buffer, size_t p_output_size, size_t p_input_size) {
 	Error error;
 
 	Vector<uint8_t> pixels;
@@ -56,11 +56,14 @@ Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t
 		compressed_pos += 1;
 		count = (c & 0x7f) + 1;
 
-		if (output_pos + count * p_pixel_size > output_pos) {
+		if (output_pos + count * p_pixel_size > p_output_size) {
 			return ERR_PARSE_ERROR;
 		}
 
 		if (c & 0x80) {
+			if (compressed_pos + p_pixel_size > p_input_size) {
+				return ERR_PARSE_ERROR;
+			}
 			for (size_t i = 0; i < p_pixel_size; i++) {
 				pixels_w[i] = p_compressed_buffer[compressed_pos];
 				compressed_pos += 1;
@@ -72,6 +75,9 @@ Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t
 				output_pos += p_pixel_size;
 			}
 		} else {
+			if (compressed_pos + count * p_pixel_size > p_input_size) {
+				return ERR_PARSE_ERROR;
+			}
 			count *= p_pixel_size;
 			for (size_t i = 0; i < count; i++) {
 				p_uncompressed_buffer[output_pos] = p_compressed_buffer[compressed_pos];
@@ -83,7 +89,7 @@ Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t
 	return OK;
 }
 
-Error ImageLoaderTGA::convert_to_image(Ref<Image> p_image, const uint8_t *p_buffer, const tga_header_s &p_header, const uint8_t *p_palette, const bool p_is_monochrome, size_t p_output_size) {
+Error ImageLoaderTGA::convert_to_image(Ref<Image> p_image, const uint8_t *p_buffer, const tga_header_s &p_header, const uint8_t *p_palette, const bool p_is_monochrome, size_t p_input_size) {
 #define TGA_PUT_PIXEL(r, g, b, a)             \
 	int image_data_ofs = ((y * width) + x);   \
 	image_data_w[image_data_ofs * 4 + 0] = r; \
@@ -134,7 +140,7 @@ Error ImageLoaderTGA::convert_to_image(Ref<Image> p_image, const uint8_t *p_buff
 		if (p_is_monochrome) {
 			while (y != y_end) {
 				while (x != x_end) {
-					if (i > p_output_size) {
+					if (i >= p_input_size) {
 						return ERR_PARSE_ERROR;
 					}
 					uint8_t shade = p_buffer[i];
@@ -150,7 +156,7 @@ Error ImageLoaderTGA::convert_to_image(Ref<Image> p_image, const uint8_t *p_buff
 		} else {
 			while (y != y_end) {
 				while (x != x_end) {
-					if (i > p_output_size) {
+					if (i >= p_input_size) {
 						return ERR_PARSE_ERROR;
 					}
 					uint8_t index = p_buffer[i];
@@ -181,7 +187,7 @@ Error ImageLoaderTGA::convert_to_image(Ref<Image> p_image, const uint8_t *p_buff
 	} else if (p_header.pixel_depth == 24) {
 		while (y != y_end) {
 			while (x != x_end) {
-				if (i + 2 > p_output_size) {
+				if (i + 2 >= p_input_size) {
 					return ERR_PARSE_ERROR;
 				}
 
@@ -200,7 +206,7 @@ Error ImageLoaderTGA::convert_to_image(Ref<Image> p_image, const uint8_t *p_buff
 	} else if (p_header.pixel_depth == 32) {
 		while (y != y_end) {
 			while (x != x_end) {
-				if (i + 3 > p_output_size) {
+				if (i + 3 >= p_input_size) {
 					return ERR_PARSE_ERROR;
 				}
 
@@ -307,7 +313,7 @@ Error ImageLoaderTGA::load_image(Ref<Image> p_image, FileAccess *f, bool p_force
 		const uint8_t *buffer = nullptr;
 
 		if (is_encoded) {
-			err = decode_tga_rle(src_image_r, pixel_size, uncompressed_buffer_w, buffer_size);
+			err = decode_tga_rle(src_image_r, pixel_size, uncompressed_buffer_w, buffer_size, src_image_len);
 
 			if (err == OK) {
 				uncompressed_buffer_r = uncompressed_buffer.ptr();
diff --git a/modules/tga/image_loader_tga.h b/modules/tga/image_loader_tga.h
index cb2ce07edd..e4463a322f 100644
--- a/modules/tga/image_loader_tga.h
+++ b/modules/tga/image_loader_tga.h
@@ -72,8 +72,8 @@ class ImageLoaderTGA : public ImageFormatLoader {
 		uint8_t pixel_depth = 0;
 		uint8_t image_descriptor = 0;
 	};
-	static Error decode_tga_rle(const uint8_t *p_compressed_buffer, size_t p_pixel_size, uint8_t *p_uncompressed_buffer, size_t p_output_size);
-	static Error convert_to_image(Ref<Image> p_image, const uint8_t *p_buffer, const tga_header_s &p_header, const uint8_t *p_palette, const bool p_is_monochrome, size_t p_output_size);
+	static Error decode_tga_rle(const uint8_t *p_compressed_buffer, size_t p_pixel_size, uint8_t *p_uncompressed_buffer, size_t p_output_size, size_t p_input_size);
+	static Error convert_to_image(Ref<Image> p_image, const uint8_t *p_buffer, const tga_header_s &p_header, const uint8_t *p_palette, const bool p_is_monochrome, size_t p_input_size);
 
 public:
 	virtual Error load_image(Ref<Image> p_image, FileAccess *f, bool p_force_linear, float p_scale);