restore R_IsPatchLump, add V_LumpSize

src/mn_font.c

@@ -157,7 +157,7 @@ boolean MN_LoadFon2(const byte *gfx_data, int size)
             }
         }
 
-        chars[i].patch = V_LinearToTransPatch(data, chars[i].width, height,
+        chars[i].patch = V_LinearToTransPatch(data, chars[i].width, height, NULL,
                                               color_key, PU_STATIC, NULL);
         free(data);
     }

src/r_data.c

@@ -1221,6 +1221,7 @@ void R_PrecacheLevel(void)
 
 boolean R_IsPatchLump (const int lump)
 {
+  int size;
   int width, height;
   const patch_t *patch;
   boolean result;
@@ -1231,10 +1232,17 @@ boolean R_IsPatchLump (const int lump)
 
   patch = V_CachePatchNum(lump, PU_CACHE);
 
+  size = V_LumpSize(lump);
+
+  // minimum length of a valid Doom patch
+  if (size < 13)
+    return false;
+
   width = SHORT(patch->width);
   height = SHORT(patch->height);
 
-  result = (height > 0 && height <= 16384 && width > 0 && width <= 16384);
+  result = (height > 0 && height <= 16384 && width > 0 && width <= 16384
+            && width < size / 4);
 
   if (result)
   {
@@ -1249,7 +1257,7 @@ boolean R_IsPatchLump (const int lump)
       unsigned int ofs = LONG(patch->columnofs[x]);
 
       // Need one byte for an empty column (but there's patches that don't know that!)
-      if (ofs < (unsigned int)width * 4 + 8)
+      if (ofs < (unsigned int)width * 4 + 8 || ofs >= (unsigned int)size)
       {
         result = false;
         break;

src/v_fmt.c

@@ -66,7 +66,8 @@ typedef struct
 // from SLADE.
 //
 patch_t *V_LinearToTransPatch(const byte *data, int width, int height,
-                              int color_key, pu_tag tag, void **user)
+                              int *output_size, int color_key, pu_tag tag,
+                              void **user)
 {
     vcolumn_t *columns = NULL;
 
@@ -238,12 +239,17 @@ patch_t *V_LinearToTransPatch(const byte *data, int width, int height,
 
     array_free(columns);
 
+    if (*output_size)
+    {
+        *output_size = size;
+    }
+
     // Done!
     return (patch_t *)output;
 }
 
-patch_t *V_LinearToPatch(byte *data, int width, int height, int tag,
+patch_t *V_LinearToPatch(byte *data, int width, int height, int *output_size,
-                         void **user)
+                         int tag, void **user)
 {
     size_t size = 0;
     size += 4 * sizeof(int16_t);                     // 4 header shorts
@@ -292,6 +298,11 @@ patch_t *V_LinearToPatch(byte *data, int width, int height, int tag,
         PUTBYTE(rover, 0xff);
     }
 
+    if (*output_size)
+    {
+        *output_size = size;
+    }
+
     return (patch_t *)output;
 }
 
@@ -572,7 +583,7 @@ static void TranslatePatch(patch_t *patch, const byte *translate)
 
     for (int i = 0; i < width; i++)
     {
-        size_t offset = patch->columnofs[i];
+        int offset = LONG(patch->columnofs[i]);
         byte *rover = (byte *)patch + offset;
 
         while (*rover != 0xff)
@@ -680,13 +691,14 @@ patch_t *V_CachePatchNum(int lump, pu_tag tag)
     patch_t *patch;
     if (png.color_key == NO_COLOR_KEY)
     {
-        patch = V_LinearToPatch(png.image, png.width, png.height, tag,
+        patch = V_LinearToPatch(png.image, png.width, png.height,
-                                &lumpcache[lump]);
+                                &lumpinfo[lump].fmt_size, tag, &lumpcache[lump]);
     }
     else
     {
         patch = V_LinearToTransPatch(png.image, png.width, png.height,
-                                     png.color_key, tag, &lumpcache[lump]);
+                                     &lumpinfo[lump].fmt_size, png.color_key,
+                                     tag, &lumpcache[lump]);
     }
     patch->leftoffset = leftoffset;
     patch->topoffset = topoffset;
@@ -762,3 +774,13 @@ error:
     return DummyFlat(lump, tag);
 }
 
+int V_LumpSize(int lump)
+{
+    if (lump >= numlumps)
+    {
+        I_Error("V_LumpFmtSize: %i >= numlumps", lump);
+    }
+
+    return lumpinfo[lump].fmt_size ? lumpinfo[lump].fmt_size
+                                   : lumpinfo[lump].size;
+}

src/v_fmt.h

@@ -13,15 +13,19 @@
 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 // GNU General Public License for more details.
 
+#ifndef V_FMT_H
+#define V_FMT_H
+
 #include "doomtype.h"
 #include "z_zone.h"
 #include "w_wad.h"
 
 struct patch_s *V_LinearToTransPatch(const byte *data, int width, int height,
-                                     int color_key, pu_tag tag, void **user);
+                                     int *output_size, int color_key,
+                                     pu_tag tag, void **user);
 
-struct patch_s *V_LinearToPatch(byte *data, int width, int height, int tag,
+struct patch_s *V_LinearToPatch(byte *data, int width, int height,
-                                void **user);
+                                int *output_size, int tag, void **user);
 
 struct patch_s *V_CachePatchNum(int lump, pu_tag tag);
 
@@ -31,3 +35,7 @@ inline static struct patch_s *V_CachePatchName(const char *name, pu_tag tag)
 }
 
 void *V_CacheFlatNum(int lump, pu_tag tag);
+
+int V_LumpSize(int lump);
+
+#endif

src/w_wad.h

@@ -87,6 +87,7 @@ typedef struct
 
   char  name[8];
   int   size;
+  int   fmt_size;
   const void *data;     // killough 1/31/98: points to predefined lump data
 
   // killough 1/31/98: hash table fields, used for ultra-fast hash table lookup