Fix overflow in GDM message length bounds check.

AliceLR · AliceLR · commit 01e4f0185a89 · 2021-06-14T05:41:15.000-06:00
diff --git a/src/load_gdm.cpp b/src/load_gdm.cpp
@@ -281,7 +281,7 @@ BOOL CSoundFile::ReadGDM(const BYTE *lpStream, DWORD dwMemLength)
 	memcpy(m_szNames[0], pfh->name, 32);
 	m_szNames[0][31] = '\0';
 
-	if ((messagePos < dwMemLength) && (messagePos + messageLen < dwMemLength))
+	if ((messagePos < dwMemLength) && (messageLen <= dwMemLength - messagePos))
 	{
 		m_lpszSongComments = new char[messageLen + 1];
 		memcpy(m_lpszSongComments, lpStream + messagePos, messageLen);

Original file line number	Diff line number	Diff line change
`@@ -281,7 +281,7 @@ BOOL CSoundFile::ReadGDM(const BYTE *lpStream, DWORD dwMemLength)`
`281`	`281`	`memcpy(m_szNames[0], pfh->name, 32);`
`282`	`282`	`m_szNames[0][31] = '\0';`
`283`	`283`
`284`		`- if ((messagePos < dwMemLength) && (messagePos + messageLen < dwMemLength))`
	`284`	`+ if ((messagePos < dwMemLength) && (messageLen <= dwMemLength - messagePos))`
`285`	`285`	`{`
`286`	`286`	`m_lpszSongComments = new char[messageLen + 1];`
`287`	`287`	`memcpy(m_lpszSongComments, lpStream + messagePos, messageLen);`