godotengine/godot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #49593 from bruvzg/tga_loader_fixes

Browse Source 
Fix loading RLE compressed TGAs and invalid memory reads.
This commit is contained in:
Rémi Verschelde 2021-06-15 00:08:35 +02:00 committed by GitHub
commit 72f39e31b1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 16 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
modules/tga/image_loader_tga.cpp
View File

@ -35,7 +35,7 @@
#include "core/os/os.h" #include "core/os/os.h"
#include "core/string/print_string.h" #include "core/string/print_string.h"
Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t p_pixel_size, uint8_t *p_uncompressed_buffer, size_t p_output_size) { Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t p_pixel_size, uint8_t *p_uncompressed_buffer, size_t p_output_size, size_t p_input_size) {
Error error; Error error;
Vector<uint8_t> pixels; Vector<uint8_t> pixels;
@ -56,11 +56,14 @@ Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t
compressed_pos += 1; compressed_pos += 1;
count = (c & 0x7f) + 1; count = (c & 0x7f) + 1;
if (output_pos + count * p_pixel_size > output_pos) { if (output_pos + count * p_pixel_size > p_output_size) {
return ERR_PARSE_ERROR; return ERR_PARSE_ERROR;
} }
if (c & 0x80) { if (c & 0x80) {
if (compressed_pos + p_pixel_size > p_input_size) {
return ERR_PARSE_ERROR;
}
for (size_t i = 0; i < p_pixel_size; i++) { for (size_t i = 0; i < p_pixel_size; i++) {
pixels_w[i] = p_compressed_buffer[compressed_pos]; pixels_w[i] = p_compressed_buffer[compressed_pos];
compressed_pos += 1; compressed_pos += 1;
@ -72,6 +75,9 @@ Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t
output_pos += p_pixel_size; output_pos += p_pixel_size;
} }
} else { } else {
if (compressed_pos + count * p_pixel_size > p_input_size) {
return ERR_PARSE_ERROR;
}
count *= p_pixel_size; count *= p_pixel_size;
for (size_t i = 0; i < count; i++) { for (size_t i = 0; i < count; i++) {
p_uncompressed_buffer[output_pos] = p_compressed_buffer[compressed_pos]; p_uncompressed_buffer[output_pos] = p_compressed_buffer[compressed_pos];
@ -83,7 +89,7 @@ Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t
return OK; return OK;
} }
Error ImageLoaderTGA::convert_to_image(Ref<Image> p_image, const uint8_t *p_buffer, const tga_header_s &p_header, const uint8_t *p_palette, const bool p_is_monochrome, size_t p_output_size) { Error ImageLoaderTGA::convert_to_image(Ref<Image> p_image, const uint8_t *p_buffer, const tga_header_s &p_header, const uint8_t *p_palette, const bool p_is_monochrome, size_t p_input_size) {
#define TGA_PUT_PIXEL(r, g, b, a) \ #define TGA_PUT_PIXEL(r, g, b, a) \
int image_data_ofs = ((y * width) + x); \ int image_data_ofs = ((y * width) + x); \
image_data_w[image_data_ofs * 4 + 0] = r; \ image_data_w[image_data_ofs * 4 + 0] = r; \
@ -134,7 +140,7 @@ Error ImageLoaderTGA::convert_to_image(Ref<Image> p_image, const uint8_t *p_buff
if (p_is_monochrome) { if (p_is_monochrome) {
while (y != y_end) { while (y != y_end) {
while (x != x_end) { while (x != x_end) {
if (i > p_output_size) { if (i >= p_input_size) {
return ERR_PARSE_ERROR; return ERR_PARSE_ERROR;
} }
uint8_t shade = p_buffer[i]; uint8_t shade = p_buffer[i];
@ -150,7 +156,7 @@ Error ImageLoaderTGA::convert_to_image(Ref<Image> p_image, const uint8_t *p_buff
} else { } else {
while (y != y_end) { while (y != y_end) {
while (x != x_end) { while (x != x_end) {
if (i > p_output_size) { if (i >= p_input_size) {
return ERR_PARSE_ERROR; return ERR_PARSE_ERROR;
} }
uint8_t index = p_buffer[i]; uint8_t index = p_buffer[i];
@ -181,7 +187,7 @@ Error ImageLoaderTGA::convert_to_image(Ref<Image> p_image, const uint8_t *p_buff
} else if (p_header.pixel_depth == 24) { } else if (p_header.pixel_depth == 24) {
while (y != y_end) { while (y != y_end) {
while (x != x_end) { while (x != x_end) {
if (i + 2 > p_output_size) { if (i + 2 >= p_input_size) {
return ERR_PARSE_ERROR; return ERR_PARSE_ERROR;
} }
@ -200,7 +206,7 @@ Error ImageLoaderTGA::convert_to_image(Ref<Image> p_image, const uint8_t *p_buff
} else if (p_header.pixel_depth == 32) { } else if (p_header.pixel_depth == 32) {
while (y != y_end) { while (y != y_end) {
while (x != x_end) { while (x != x_end) {
if (i + 3 > p_output_size) { if (i + 3 >= p_input_size) {
return ERR_PARSE_ERROR; return ERR_PARSE_ERROR;
} }
@ -307,7 +313,7 @@ Error ImageLoaderTGA::load_image(Ref<Image> p_image, FileAccess *f, bool p_force
const uint8_t *buffer = nullptr; const uint8_t *buffer = nullptr;
if (is_encoded) { if (is_encoded) {
err = decode_tga_rle(src_image_r, pixel_size, uncompressed_buffer_w, buffer_size); err = decode_tga_rle(src_image_r, pixel_size, uncompressed_buffer_w, buffer_size, src_image_len);
if (err == OK) { if (err == OK) {
uncompressed_buffer_r = uncompressed_buffer.ptr(); uncompressed_buffer_r = uncompressed_buffer.ptr();

4
modules/tga/image_loader_tga.h
View File

@ -72,8 +72,8 @@ class ImageLoaderTGA : public ImageFormatLoader {
uint8_t pixel_depth = 0; uint8_t pixel_depth = 0;
uint8_t image_descriptor = 0; uint8_t image_descriptor = 0;
}; };
static Error decode_tga_rle(const uint8_t *p_compressed_buffer, size_t p_pixel_size, uint8_t *p_uncompressed_buffer, size_t p_output_size); static Error decode_tga_rle(const uint8_t *p_compressed_buffer, size_t p_pixel_size, uint8_t *p_uncompressed_buffer, size_t p_output_size, size_t p_input_size);
static Error convert_to_image(Ref<Image> p_image, const uint8_t *p_buffer, const tga_header_s &p_header, const uint8_t *p_palette, const bool p_is_monochrome, size_t p_output_size); static Error convert_to_image(Ref<Image> p_image, const uint8_t *p_buffer, const tga_header_s &p_header, const uint8_t *p_palette, const bool p_is_monochrome, size_t p_input_size);
public: public:
virtual Error load_image(Ref<Image> p_image, FileAccess *f, bool p_force_linear, float p_scale); virtual Error load_image(Ref<Image> p_image, FileAccess *f, bool p_force_linear, float p_scale);