diff options
| author | pavelkproductengine <pavelkproductengine@lindenlab.com> | 2016-01-28 15:34:10 +0200 |
|---|---|---|
| committer | pavelkproductengine <pavelkproductengine@lindenlab.com> | 2016-01-28 15:34:10 +0200 |
| commit | cdc7229e11ecab9d38a97ddc71c31b0459dd85f6 (patch) | |
| tree | 4e78b8f8b573ea8fd43780fd7149e9d4854418b9 /indra/llimage/llimagebmp.cpp | |
| parent | 81ecf0c0f304aef72f8b558c732b5ed62acfb946 (diff) | |
| parent | 5a5c023e291990a463b1a91846ce82c70da8daab (diff) | |
Merge MAINT-5194 Visual Outfit Browser with Release
Diffstat (limited to 'indra/llimage/llimagebmp.cpp')
| -rwxr-xr-x | indra/llimage/llimagebmp.cpp | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/indra/llimage/llimagebmp.cpp b/indra/llimage/llimagebmp.cpp index 8573fe0d91..a2ce2fee86 100755 --- a/indra/llimage/llimagebmp.cpp +++ b/indra/llimage/llimagebmp.cpp @@ -443,6 +443,10 @@ BOOL LLImageBMP::decodeColorMask32( U8* dst, U8* src ) mBitfieldMask[2] = 0x000000FF; } + if (getWidth() * getHeight() * 4 > getDataSize() - mBitmapOffset) + { //here we have situation when data size in src less than actually needed + return FALSE; + } S32 src_row_span = getWidth() * 4; S32 alignment_bytes = (3 * src_row_span) % 4; // round up to nearest multiple of 4 @@ -476,6 +480,11 @@ BOOL LLImageBMP::decodeColorTable8( U8* dst, U8* src ) S32 src_row_span = getWidth() * 1; S32 alignment_bytes = (3 * src_row_span) % 4; // round up to nearest multiple of 4 + if ((getWidth() * getHeight()) + getHeight() * alignment_bytes > getDataSize() - mBitmapOffset) + { //here we have situation when data size in src less than actually needed + return FALSE; + } + for( S32 row = 0; row < getHeight(); row++ ) { for( S32 col = 0; col < getWidth(); col++ ) @@ -501,6 +510,11 @@ BOOL LLImageBMP::decodeTruecolor24( U8* dst, U8* src ) S32 src_row_span = getWidth() * 3; S32 alignment_bytes = (3 * src_row_span) % 4; // round up to nearest multiple of 4 + if ((getWidth() * getHeight() * 3) + getHeight() * alignment_bytes > getDataSize() - mBitmapOffset) + { //here we have situation when data size in src less than actually needed + return FALSE; + } + for( S32 row = 0; row < getHeight(); row++ ) { for( S32 col = 0; col < getWidth(); col++ ) |