1 files changed, 50 insertions, 0 deletions

diff --git a/linden/indra/llimage/llimagetga.cpp b/linden/indra/llimage/llimagetga.cpp
index 39da50a..805297f 100644
--- a/linden/indra/llimage/llimagetga.cpp
+++ b/linden/indra/llimage/llimagetga.cpp
@@ -1,6 +1,8 @@
 /** 
  * @file llimagetga.cpp
  *
+ * $LicenseInfo:firstyear=2001&license=viewergpl$
+ * 
  * Copyright (c) 2001-2007, Linden Research, Inc.
  * 
  * Second Life Viewer Source Code
@@ -23,6 +25,7 @@
  * ALL LINDEN LAB SOURCE CODE IS PROVIDED "AS IS." LINDEN LAB MAKES NO
  * WARRANTIES, EXPRESS, IMPLIED OR OTHERWISE, REGARDING ITS ACCURACY,
  * COMPLETENESS OR PERFORMANCE.
+ * $/LicenseInfo$
  */
 
 #include "linden_common.h"
@@ -747,6 +750,7 @@ BOOL LLImageTGA::decodeTruecolorRle32( LLImageRaw* raw_image, BOOL &alpha_opaque
         U32* dst_pixels = (U32*) dst;
 
         U8* src = getData() + mDataOffset;
+        U8* last_src = src + getDataSize();
 
         U32 rgba;
         U8* rgba_byte_p = (U8*) &rgba;
@@ -755,6 +759,10 @@ BOOL LLImageTGA::decodeTruecolorRle32( LLImageRaw* raw_image, BOOL &alpha_opaque
         while( dst_pixels <= last_dst_pixel )
         {
                 // Read RLE block header
+                
+                if (src >= last_src)
+                        return FALSE;
+
                 U8 block_header_byte = *src;
                 src++;
 
@@ -762,6 +770,10 @@ BOOL LLImageTGA::decodeTruecolorRle32( LLImageRaw* raw_image, BOOL &alpha_opaque
                 if( block_header_byte & 0x80 )
                 {
                         // Encoded (duplicate-pixel) block
+
+                        if (src + 3 >= last_src)
+                                return FALSE;
+                        
                         rgba_byte_p[0] = src[2];
                         rgba_byte_p[1] = src[1];
                         rgba_byte_p[2] = src[0];
@@ -786,6 +798,9 @@ BOOL LLImageTGA::decodeTruecolorRle32( LLImageRaw* raw_image, BOOL &alpha_opaque
                         // Unencoded block
                         do
                         {
+                                if (src + 3 >= last_src)
+                                        return FALSE;
+                                
                                 ((U8*)dst_pixels)[0] = src[2];
                                 ((U8*)dst_pixels)[1] = src[1];
                                 ((U8*)dst_pixels)[2] = src[0];
@@ -813,10 +828,16 @@ BOOL LLImageTGA::decodeTruecolorRle15( LLImageRaw* raw_image )
         U8* dst = raw_image->getData();
         U8* src = getData() + mDataOffset;
 
+        U8* last_src = src + getDataSize();
         U8* last_dst = dst + getComponents() * (getHeight() * getWidth() - 1);
+
         while( dst <= last_dst )
         {
                 // Read RLE block header
+
+                if (src >= last_src)
+                        return FALSE;
+
                 U8 block_header_byte = *src;
                 src++;
 
@@ -826,6 +847,9 @@ BOOL LLImageTGA::decodeTruecolorRle15( LLImageRaw* raw_image )
                         // Encoded (duplicate-pixel) block
                         do
                         {
+                                if (src + 2 >= last_src)
+                                        return FALSE;
+                                
                                 decodeTruecolorPixel15( dst, src );   // slow
                                 dst += 3;
                                 block_pixel_count--;
@@ -838,6 +862,9 @@ BOOL LLImageTGA::decodeTruecolorRle15( LLImageRaw* raw_image )
                         // Unencoded block
                         do
                         {
+                                if (src + 2 >= last_src)
+                                        return FALSE;
+
                                 decodeTruecolorPixel15( dst, src );
                                 dst += 3;
                                 src += 2;
@@ -859,10 +886,16 @@ BOOL LLImageTGA::decodeTruecolorRle24( LLImageRaw* raw_image )
         U8* dst = raw_image->getData();
         U8* src = getData() + mDataOffset;
 
+        U8* last_src = src + getDataSize();
         U8* last_dst = dst + getComponents() * (getHeight() * getWidth() - 1);
+
         while( dst <= last_dst )
         {
                 // Read RLE block header
+
+                if (src >= last_src)
+                        return FALSE;
+        
                 U8 block_header_byte = *src;
                 src++;
 
@@ -872,6 +905,8 @@ BOOL LLImageTGA::decodeTruecolorRle24( LLImageRaw* raw_image )
                         // Encoded (duplicate-pixel) block
                         do
                         {
+                                if (src + 2 >= last_src)
+                                        return FALSE;
                                 dst[0] = src[2];
                                 dst[1] = src[1];
                                 dst[2] = src[0];
@@ -886,6 +921,9 @@ BOOL LLImageTGA::decodeTruecolorRle24( LLImageRaw* raw_image )
                         // Unencoded block
                         do
                         {
+                                if (src + 2 >= last_src)
+                                        return FALSE;
+                                
                                 dst[0] = src[2];
                                 dst[1] = src[1];
                                 dst[2] = src[0];
@@ -908,16 +946,25 @@ BOOL LLImageTGA::decodeTruecolorRle8( LLImageRaw* raw_image )
         U8* dst = raw_image->getData();
         U8* src = getData() + mDataOffset;
 
+        U8* last_src = src + getDataSize();
         U8* last_dst = dst + getHeight() * getWidth() - 1;
+        
         while( dst <= last_dst )
         {
                 // Read RLE block header
+
+                if (src >= last_src)
+                        return FALSE;
+
                 U8 block_header_byte = *src;
                 src++;
 
                 U8 block_pixel_count = (block_header_byte & 0x7F) + 1;
                 if( block_header_byte & 0x80 )
                 {
+                        if (src >= last_src)
+                                return FALSE;
+                        
                         // Encoded (duplicate-pixel) block
                         memset( dst, *src, block_pixel_count );
                         dst += block_pixel_count;
@@ -928,6 +975,9 @@ BOOL LLImageTGA::decodeTruecolorRle8( LLImageRaw* raw_image )
                         // Unencoded block
                         do
                         {
+                                if (src >= last_src)
+                                        return FALSE;
+                                
                                 *dst = *src;
                                 dst++;
                                 src++;