commit 7966b4ed992915089e5e77adce1369e2642fa888
author Lucas Dupin <dupin@google.com> Thu Apr 06 17:44:08 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Thu May 25 17:44:39 2017 +0000
tree 3b2aeb489a89efdf9800f46caffa112e14da7d34
parent 1562b0af20f6fb5933fe7843fa52b3bac94b68d4

Fix 36385715 heap overflow when loading HDR files

Change-Id: I0fa1f69b4d87e32cfbd559db472cc89304ae2b37
Fix: 36385715
Test: PoC
(cherry picked from commit e6247a186731f593924c316382d4971f90126265)

gdx/jni/gdx2d/stb_image.h

diff --git a/gdx/jni/gdx2d/stb_image.h b/gdx/jni/gdx2d/stb_image.h
index 23254d6..1e48cc4 100644
--- a/gdx/jni/gdx2d/stb_image.h
+++ b/gdx/jni/gdx2d/stb_image.h
@@ -6064,10 +6064,15 @@
                   // Run
                   value = stbi__get8(s);
                   count -= 128;
+                  if (count >= width - i) {
+                     STBI_FREE(hdr_data);
+                     STBI_FREE(scanline);
+                     return stbi__errpf("invalid buffer size", "corrupt HDR");
+                  }
                   for (z = 0; z < count; ++z)
                      scanline[i++ * 4 + k] = value;
                } else {
-                  if (count > len) {
+                  if (count >= width - i) {
                      STBI_FREE(hdr_data);
                      STBI_FREE(scanline);
                      return stbi__errpf("invalid buffer size", "corrupt HDR");