Merge pull request #118 from OpenFodder/codex/propose-fix-for-vulnerability-in-asset-loading

Guard PC resource buffer accesses against truncated DAT files

Author: segrax

Source/Graphics.hpp

@@ -77,6 +77,10 @@ struct sImage {
 	void LoadPalette(size_t pFrom, const size_t pCount, const size_t pStartColorID = 0) {
 
 		auto Buffer = mData->data();
+		const size_t BufferSize = mData->size();
+		const size_t PaletteBytes = pCount * 3;
+		if (pFrom >= BufferSize || (BufferSize - pFrom) < PaletteBytes)
+			return;
 
 		for (size_t ColorID = pStartColorID; ColorID < pStartColorID + pCount; ColorID++) {
 

Source/PC/Graphics_PC.cpp

@@ -203,7 +203,8 @@ void cGraphics_PC::Load_Hill_Data() {
 
 	// Parts of this surface have the recruits from mImageRecruit copied onto it
 	mImageHillSprites = Decode_Image("hill.dat", 0x50, 0xFA00, 0x00);
-	for (uint32 x = 0; x < 0xA000; ++x) {
+	const uint32 ClearCount = std::min<uint32>(0xA000, mImageHillSprites.mData->size());
+	for (uint32 x = 0; x < ClearCount; ++x) {
 		mImageHillSprites.mData->data()[x] = 0;
 	}
 }