comparison tools/lib64gfx.c @ 1416:3baed76155a1

Fix dmDecodeGenericRLE() source/read bounds check.
author Matti Hamalainen <ccr@tnsp.org>
date Sun, 05 Nov 2017 04:47:13 +0200
parents c386d287fa1e
children d8a509d72449
comparison
equal deleted inserted replaced
1415:1e4fb7c5527f 1416:3baed76155a1
218 return DMERR_MALLOC; 218 return DMERR_MALLOC;
219 219
220 dst = *mem; 220 dst = *mem;
221 dstEnd = *mem + C64_RAM_SIZE; 221 dstEnd = *mem + C64_RAM_SIZE;
222 222
223 while (src <= srcEnd && dst <= dstEnd) 223 while (src < srcEnd && dst <= dstEnd)
224 { 224 {
225 Uint8 c = *src++; 225 Uint8 c = *src++;
226 if (c == rleMarker && src + 2 <= srcEnd) 226 if (c == rleMarker && src + 2 < srcEnd)
227 { 227 {
228 int cnt = *src++; 228 int cnt = *src++;
229 c = *src++; 229 c = *src++;
230 while (cnt-- && dst <= dstEnd) 230 while (cnt-- && dst <= dstEnd)
231 *dst++ = c; 231 *dst++ = c;