diff --git a/src/engine/shared/map.cpp b/src/engine/shared/map.cpp index d38bab669..ad63e6fd5 100644 --- a/src/engine/shared/map.cpp +++ b/src/engine/shared/map.cpp @@ -55,14 +55,24 @@ public: if(pTilemap->m_Version > 3) { - CTile *pTiles = static_cast(mem_alloc(pTilemap->m_Width * pTilemap->m_Height * sizeof(CTile), 1)); + const int TilemapCount = pTilemap->m_Width * pTilemap->m_Height; + const int TilemapSize = TilemapCount * sizeof(CTile); + + if((TilemapCount / pTilemap->m_Width != pTilemap->m_Height) || (TilemapSize / sizeof(CTile) != TilemapCount)) + { + dbg_msg("engine", "map layer too big (%d * %d * %d causes an integer overflow)", pTilemap->m_Width, pTilemap->m_Height, sizeof(CTile)); + return false; + } + CTile *pTiles = static_cast(mem_alloc(TilemapSize, 1)); + if(!pTiles) + return false; // extract original tile data int i = 0; CTile *pSavedTiles = static_cast(m_DataFile.GetData(pTilemap->m_Data)); - while(i < pTilemap->m_Width * pTilemap->m_Height) + while(i < TilemapCount) { - for(unsigned Counter = 0; Counter <= pSavedTiles->m_Skip && i < pTilemap->m_Width * pTilemap->m_Height; Counter++) + for(unsigned Counter = 0; Counter <= pSavedTiles->m_Skip && i < TilemapCount; Counter++) { pTiles[i] = *pSavedTiles; pTiles[i++].m_Skip = 0;