diff options
Diffstat (limited to 'modules/bmp/image_loader_bmp.cpp')
| -rw-r--r-- | modules/bmp/image_loader_bmp.cpp | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/modules/bmp/image_loader_bmp.cpp b/modules/bmp/image_loader_bmp.cpp index 171895ed24..3d47055247 100644 --- a/modules/bmp/image_loader_bmp.cpp +++ b/modules/bmp/image_loader_bmp.cpp @@ -91,11 +91,13 @@ Error ImageLoaderBMP::convert_to_image(Ref<Image> p_image, // the data width in case of 8/4/1 bit images const uint32_t w = bits_per_pixel >= 24 ? width : width_bytes; const uint8_t *line = p_buffer + (line_width * (height - 1)); + const uint8_t *end_buffer = p_buffer + p_header.bmp_file_header.bmp_file_size - p_header.bmp_file_header.bmp_file_offset; for (uint64_t i = 0; i < height; i++) { const uint8_t *line_ptr = line; for (unsigned int j = 0; j < w; j++) { + ERR_FAIL_COND_V(line_ptr >= end_buffer, ERR_FILE_CORRUPT); switch (bits_per_pixel) { case 1: { uint8_t color_index = *line_ptr; @@ -246,8 +248,7 @@ Error ImageLoaderBMP::load_image(Ref<Image> p_image, FileAccess *f, } // Don't rely on sizeof(bmp_file_header) as structure padding // adds 2 bytes offset leading to misaligned color table reading - uint32_t ct_offset = BITMAP_FILE_HEADER_SIZE + - bmp_header.bmp_info_header.bmp_header_size; + uint32_t ct_offset = BITMAP_FILE_HEADER_SIZE + bmp_header.bmp_info_header.bmp_header_size; f->seek(ct_offset); uint32_t color_table_size = 0; @@ -269,8 +270,7 @@ Error ImageLoaderBMP::load_image(Ref<Image> p_image, FileAccess *f, f->seek(bmp_header.bmp_file_header.bmp_file_offset); - uint32_t bmp_buffer_size = (bmp_header.bmp_file_header.bmp_file_size - - bmp_header.bmp_file_header.bmp_file_offset); + uint32_t bmp_buffer_size = (bmp_header.bmp_file_header.bmp_file_size - bmp_header.bmp_file_header.bmp_file_offset); Vector<uint8_t> bmp_buffer; err = bmp_buffer.resize(bmp_buffer_size); |