Turo Lamminen
2015-04-30 a8008ff154be8a49a2a541854bfcdb2d382020f2

Fix crash when width * height would overflow uint32

Found with AFL

1 files modified
6 ■■■■■ changed files
mojodds.c 6 ●●●●● patch | view | raw | blame | history
mojodds.c
@@ -168,6 +168,12 @@
    width = header->dwWidth;
    height = header->dwHeight;
    // check for overflow in width * height
    if (height > 0xFFFFFFFFU / width)
    {
        return 0;
    }
    header->dwCaps &= ~DDSCAPS_ALPHA;  // we'll get this from the pixel format.
    if (header->dwSize != DDS_HEADERSIZE)   // header size must be 124.