mirror of
https://github.com/wxWidgets/wxWidgets.git
synced 2026-08-18 01:19:45 +08:00
MarkLee131
a546a7c518
ReadTGA() sized both the image and its scratch buffer from the header's width, height and bpp without comparing them against the input stream, and never checked how much data the bulk reads actually returned. A 22 byte file declaring a 31232x16382 image at 24bpp therefore allocated 1.5 GB twice over, and, because a short read went undetected, LoadFile() returned true and handed back an image of the declared size that the file never contained. Reject dimensions whose claimed image size cannot fit the stream before allocating anything: uncompressed types must fit exactly, while the RLE variants are allowed up to 128:1 expansion, since each packet costs 1 + pixelSize input bytes and yields at most 128 * pixelSize output bytes. Also check LastRead() after the header read and after each of the three uncompressed bulk reads, so that a truncated file is reported as a failure instead of a success, as imagpcx.cpp has done since #26624; DecodeRLE() already validated its own reads. Fixes #26760. Closes #26761.
