TheCloud/panda3d
1
0
Fork 0
mirror of https://github.com/panda3d/panda3d.git synced 2025-10-02 09:52:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/release/1.9.x'

Browse Source
This commit is contained in:
rdb 2016-12-05 02:01:44 +01:00
commit 6dc6b05409
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
panda/src/gobj/texture.cxx
View File

@ -10129,6 +10129,14 @@ do_fillin_body(CData *cdata, DatagramIterator &scan, BamReader *manager) {
cdata->_simple_image_date_generated = scan.get_int32(); cdata->_simple_image_date_generated = scan.get_int32();
size_t u_size = scan.get_uint32(); size_t u_size = scan.get_uint32();
// Protect against large allocation.
if (u_size > scan.get_remaining_size()) {
gobj_cat.error()
<< "simple RAM image extends past end of datagram, is texture corrupt?\n";
return;
}
PTA_uchar image = PTA_uchar::empty_array(u_size, get_class_type()); PTA_uchar image = PTA_uchar::empty_array(u_size, get_class_type());
scan.extract_bytes(image.p(), u_size); scan.extract_bytes(image.p(), u_size);
@ -10183,6 +10191,14 @@ do_fillin_rawdata(CData *cdata, DatagramIterator &scan, BamReader *manager) {
// fill the cdata->_image buffer with image data // fill the cdata->_image buffer with image data
size_t u_size = scan.get_uint32(); size_t u_size = scan.get_uint32();
// Protect against large allocation.
if (u_size > scan.get_remaining_size()) {
gobj_cat.error()
<< "RAM image " << n << " extends past end of datagram, is texture corrupt?\n";
return;
}
PTA_uchar image = PTA_uchar::empty_array(u_size, get_class_type()); PTA_uchar image = PTA_uchar::empty_array(u_size, get_class_type());
scan.extract_bytes(image.p(), u_size); scan.extract_bytes(image.p(), u_size);