Fix heap overflow when loading a PSD. bug 36368305
Change-Id: I15192b7dc056050a04cc7ce0b93b3c0e5406e694
diff --git a/gdx/jni/gdx2d/stb_image.h b/gdx/jni/gdx2d/stb_image.h
index d91b308..a9d338a 100644
--- a/gdx/jni/gdx2d/stb_image.h
+++ b/gdx/jni/gdx2d/stb_image.h
@@ -5228,6 +5228,10 @@
} else if (len < 128) {
// Copy next len+1 bytes literally.
len++;
+ if (len >= pixelCount - count) {
+ STBI_FREE(out);
+ return stbi__errpuc("corruptfile", "Corrupt PSD file");
+ }
count += len;
while (len) {
*p = stbi__get8(s);
@@ -5241,6 +5245,10 @@
len ^= 0x0FF;
len += 2;
val = stbi__get8(s);
+ if (len >= pixelCount - count) {
+ STBI_FREE(out);
+ return stbi__errpuc("corruptfile", "Corrupt PSD file");
+ }
count += len;
while (len) {
*p = val;