Skip to content

Commit 7b5946c

Browse files
committed
Disallow unknown BMP header sizes, to prevent them being misread.
Allowed sizes are: 12: OS/2 V1 (BITMAPCOREHEADER) 40: BITMAPINFOHEADER 56: BITMAPV3HEADER (undocumented) 108: BITMAPV4HEADER 124: BITMAPV5HEADER
1 parent c0b5f48 commit 7b5946c

File tree

2 files changed

+14
-1
lines changed

2 files changed

+14
-1
lines changed

changelog.txt

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,8 @@ Version 1.01.0
5454
- DRAW was not unsetting the B/N qualifiers after 0-length directional commands, e.g. "R0", resulting in them being applied to the following command, e.g. DRAW "B U0D0L0R0 R10" would not draw "R10"
5555
- Bad code was generated when initializing integer variables with a wstring-indexing expressions
5656
- #723: LINE clipping now doesn't affect which (unclipped) pixels are plotted, eliminating rounding differences and correctly preserving the position of the style bits
57-
- BLOAD was silently misreading bitfields for BMPs with BITMAPV3HEADER format (56-byte) headers
57+
- BLOAD now gives an error if it encounters a BMP file with an unknown header size
58+
- BLOAD was misreading bitfields in BMP files with undocumented BITMAPV3HEADER format (56-byte headers)
5859

5960

6061
Version 1.00.0 (former 0.91.0):

src/gfxlib2/gfx_bload.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,18 @@ static int load_bmp(FB_GFXCTX *ctx, FILE *f, void *dest, void *pal, int usenewhe
201201
(!fread_32_le(&biSize, f)))
202202
return FB_RTERROR_FILEIO;
203203

204+
switch (biSize)
205+
{
206+
case 12: /* OS/2 V1 (BITMAPCOREHEADER) */
207+
case 40: /* BITMAPINFOHEADER */
208+
case 56: /* BITMAPV3HEADER (undocumented) */
209+
case 108: /* BITMAPV4HEADER */
210+
case 124: /* BITMAPV5HEADER */
211+
break;
212+
default:
213+
return FB_RTERROR_FILEIO;
214+
}
215+
204216
if (biSize == 12) {
205217
/* OS/2 V1 (BITMAPCOREHEADER) */
206218
if ((!fread_16_le(&bcWidth, f)) ||

0 commit comments

Comments
 (0)