gronod/OpenTTD
1
0
Fork 0
mirror of https://github.com/OpenTTD/OpenTTD.git synced 2025-03-06 14:27:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix: do not allow more palette colours than there are indices for the colours

Browse Source 
Or: do not pass unchecked size from BMP file into memory allocation
This commit is contained in:
Rubidium 2023-01-03 18:50:33 +01:00 committed by rubidium42
parent 3af2c7fff6
commit a0694759a1
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/bmp.cpp
View File

@ -367,7 +367,12 @@ bool BmpReadHeader(BmpBuffer *buffer, BmpInfo *info, BmpData *data)
info->palette_size = ReadDword(buffer); // number of colours in palette
SkipBytes(buffer, header_size - 16); // skip the end of info header
}
if (info->palette_size == 0) info->palette_size = 1 << info->bpp;
uint maximum_palette_size = 1U << info->bpp;
if (info->palette_size == 0) info->palette_size = maximum_palette_size;
/* More palette colours than palette indices is not supported. */
if (info->palette_size > maximum_palette_size) return false;
data->palette = CallocT<Colour>(info->palette_size);