edg-l/ddnet
1
0
Fork 0
mirror of https://github.com/ddnet/ddnet.git synced 2024-11-10 10:08:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix possible integer overflows using mem_* functions

Browse source
This commit is contained in:
Robert Müller 2023-02-19 13:45:48 +01:00
parent 18cfbb53f9
commit ec7f5560a3
3 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/engine/client/text.cpp
View file

@ -540,7 +540,7 @@ class CTextRender : public IEngineTextRender
if(Width > 0 && Height > 0) if(Width > 0 && Height > 0)
{ {
// prepare glyph data // prepare glyph data
mem_zero(ms_aGlyphData, Width * Height); mem_zero(ms_aGlyphData, (size_t)Width * Height);
for(py = 0; py < pBitmap->rows; py++) for(py = 0; py < pBitmap->rows; py++)
for(px = 0; px < pBitmap->width; px++) for(px = 0; px < pBitmap->width; px++)

5
src/game/editor/io.cpp
View file

@ -511,8 +511,9 @@ bool CEditorMap::Load(class IStorage *pStorage, const char *pFileName, int Stora
// copy image data // copy image data
void *pData = DataFile.GetData(pItem->m_ImageData); void *pData = DataFile.GetData(pItem->m_ImageData);
pImg->m_pData = malloc((size_t)pImg->m_Width * pImg->m_Height * 4); const size_t DataSize = (size_t)pImg->m_Width * pImg->m_Height * 4;
mem_copy(pImg->m_pData, pData, pImg->m_Width * pImg->m_Height * 4); pImg->m_pData = malloc(DataSize);
mem_copy(pImg->m_pData, pData, DataSize);
int TextureLoadFlag = m_pEditor->Graphics()->HasTextureArrays() ? IGraphics::TEXLOAD_TO_2D_ARRAY_TEXTURE : IGraphics::TEXLOAD_TO_3D_TEXTURE; int TextureLoadFlag = m_pEditor->Graphics()->HasTextureArrays() ? IGraphics::TEXLOAD_TO_2D_ARRAY_TEXTURE : IGraphics::TEXLOAD_TO_3D_TEXTURE;
if(pImg->m_Width % 16 != 0 || pImg->m_Height % 16 != 0) if(pImg->m_Width % 16 != 0 || pImg->m_Height % 16 != 0)
TextureLoadFlag = 0; TextureLoadFlag = 0;

2
src/tools/map_optimize.cpp
View file

@ -250,7 +250,7 @@ int main(int argc, const char **argv)
} }
else if(aImageFlags[ImageIndex] == 0) else if(aImageFlags[ImageIndex] == 0)
{ {
mem_zero(pImgBuff, Width * Height * 4); mem_zero(pImgBuff, (size_t)Width * Height * 4);
} }
else else
{ {