# HG changeset patch
# User Ryan C. Gordon <icculus@icculus.org>
# Date 1518038334 18000
# Node ID c5f9cbb5d2bbcb2150ba0596ea56b49efeed660d
# Parent  2938fc80591abeae74b971cbdf966eff3213297e
xcf: Prevent infinite loop and/or buffer overflow on bogus data.

diff -r 2938fc80591a -r c5f9cbb5d2bb IMG_xcf.c
--- a/IMG_xcf.c	Wed Feb 07 15:43:51 2018 -0500
+++ b/IMG_xcf.c	Wed Feb 07 16:18:54 2018 -0500
@@ -483,6 +483,10 @@
   int i, size, count, j, length;
   unsigned char val;
 
+  if (len == 0) {  /* probably bogus data. */
+    return NULL;
+  }
+
   t = load = (unsigned char *) SDL_malloc (len);
   reallen = SDL_RWread (src, t, 1, len);
 
@@ -608,6 +612,16 @@
        ox, oy);
       }
 
+      if (!tile) {
+          if (hierarchy) {
+              free_xcf_hierarchy(hierarchy);
+          }
+          if (level) {
+              free_xcf_level(level);
+          }
+          return 1;
+      }
+
       p8  = tile;
       p16 = (Uint16 *) p8;
       p   = (Uint32 *) p8;