livie
/
phoenix-firestorm
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MAINT-5343 (Viewer sometimes crashes when updating a local tga texture when RLE or BMP compression is disabled - LLImageTGA::decodeTruecolorNonRle)

master
ruslantproductengine 2015-08-04 17:51:58 +03:00
parent 1764ac9349
commit ff3e1ae7d6
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
indra/llimage/llimagebmp.cpp
View File

@ -443,6 +443,10 @@ BOOL LLImageBMP::decodeColorMask32( U8* dst, U8* src )
mBitfieldMask[2] = 0x000000FF;
}
if (getWidth() * getHeight() * 4 > getDataSize() - mBitmapOffset)
{ //here we have situation when data size in src less than actually needed
return FALSE;
}
S32 src_row_span = getWidth() * 4;
S32 alignment_bytes = (3 * src_row_span) % 4; // round up to nearest multiple of 4
@ -476,6 +480,11 @@ BOOL LLImageBMP::decodeColorTable8( U8* dst, U8* src )
S32 src_row_span = getWidth() * 1;
S32 alignment_bytes = (3 * src_row_span) % 4; // round up to nearest multiple of 4
if ((getWidth() * getHeight()) + getHeight() * alignment_bytes > getDataSize() - mBitmapOffset)
{ //here we have situation when data size in src less than actually needed
return FALSE;
}
for( S32 row = 0; row < getHeight(); row++ )
{
for( S32 col = 0; col < getWidth(); col++ )
@ -501,6 +510,11 @@ BOOL LLImageBMP::decodeTruecolor24( U8* dst, U8* src )
S32 src_row_span = getWidth() * 3;
S32 alignment_bytes = (3 * src_row_span) % 4; // round up to nearest multiple of 4
if ((getWidth() * getHeight() * 3) + getHeight() * alignment_bytes > getDataSize() - mBitmapOffset)
{ //here we have situation when data size in src less than actually needed
return FALSE;
}
for( S32 row = 0; row < getHeight(); row++ )
{
for( S32 col = 0; col < getWidth(); col++ )

6
indra/llimage/llimagetga.cpp
View File

@ -437,7 +437,13 @@ BOOL LLImageTGA::decodeTruecolorNonRle( LLImageRaw* raw_image, BOOL &alpha_opaqu
// Origin is the bottom left
U8* dst = raw_image->getData();
U8* src = getData() + mDataOffset;
S32 pixels = getWidth() * getHeight();
if (pixels * (mIs15Bit ? 2 : getComponents()) > getDataSize() - mDataOffset)
{ //here we have situation when data size in src less than actually needed
return FALSE;
}
if (getComponents() == 4)
{