Fix OOM with obviously corrupt miptex lumps (eg: jvoxdm1.bsp).

nick-hopoo · Apr 17, 2023 · 5ed4012 · 5ed4012
1 parent 5272331
commit 5ed4012
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/engine/gl/gl_model.c b/engine/gl/gl_model.c
@@ -3737,6 +3737,12 @@ TRACE(("dbg: Mod_LoadTextures: inittexturedescs\n"));
 
 	m->nummiptex = LittleLong (m->nummiptex);
 
+	if ((1+m->nummiptex)*sizeof(int) > l->filelen)
+	{
+		Con_Printf(CON_WARNING "warning: %s contains corrupt texture lump\n", loadmodel->name);
+		return false;
+	}
+
 	loadmodel->numtextures = m->nummiptex;
 	loadmodel->textures = ZG_Malloc(&loadmodel->memgroup, m->nummiptex * sizeof(*loadmodel->textures));
 	sizes = alloca(sizeof(*sizes)*m->nummiptex);