summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrey Nazarov <skuller@skuller.net>2012-11-28 18:23:03 +0400
committerAndrey Nazarov <skuller@skuller.net>2012-11-28 18:23:03 +0400
commitc5087ab026e5580d78084f8431052ee1d2fd57dd (patch)
treebc38330a6bc2045c8a02a528b9f6a7d235f0819d
parentfb0cafad29030d270a0b16dca047477ba9701368 (diff)
Disallow too small PCX scanline size.
-rw-r--r--src/refresh/images.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/src/refresh/images.c b/src/refresh/images.c
index 522b96f..567723e 100644
--- a/src/refresh/images.c
+++ b/src/refresh/images.c
@@ -101,6 +101,9 @@ static qerror_t _IMG_LoadPCX(byte *rawdata, size_t rawlen,
}
scan = LittleShort(pcx->bytes_per_line);
+ if (scan < w) {
+ return Q_ERR_INVALID_FORMAT;
+ }
//
// get palette