Changeset 69d4aba in mainline

Timestamp:

2024-08-22T13:08:34Z (4 months ago)

Author:

Jiří Zárevúcky <zarevucky.jiri@…>

Branches:

master

Children:

cde067e

Parents:

7268bf1

Message:

libgfximage: Fix integer multiplication overflow in TGA parser

File:

• uspace/lib/gfximage/src/tga.c (modified) (1 diff)

uspace/lib/gfximage/src/tga.c

@@ -155 +155 @@
         tga->img_alpha_dir = (head->img_descr & 0xf0) >> 4;
         tga->img_data = tga->cmap_data + tga->cmap_length;
-        tga->img_length = ALIGN_UP(tga->width * tga->height * tga->img_bpp, 8) >> 3;
+
+        uint64_t length = (uint64_t) tga->width * tga->height * tga->img_bpp;
+        if (length & 0x7)
+                length += 8;
+        length >>= 3;
+
+        if (length > SIZE_MAX - sizeof(tga_header_t) - tga->id_length -
+            tga->cmap_length)
+                return false;
+
+        tga->img_length = length;
 
         if (size < sizeof(tga_header_t) + tga->id_length +