Offset sanity checks

demo/common.h

@@ -45,6 +45,7 @@ void write(const char *filename,
         fclose(out);
         if (written == 0) {
             perror("write error");
+            exit(4);
         }
     }
 }
@@ -61,6 +62,7 @@ void append(const char *filename, const char *t, unsigned size) {
         fclose(out);
         if (written == 0) {
             perror("write error");
+            exit(4);
         }
     }
 }

demo/extractmesh.c

@@ -57,8 +57,8 @@ void writemesh(const struct MeshHeader *mh,
 }
 
 void extractmeshes(const char *filedata,
-                   unsigned int filesize,
-                   const char *filename) {
+                   const char *filename,
+                   unsigned int filesize) {
     if (filedata == NULL || filesize <= 0) {
         return;
     }
@@ -83,7 +83,7 @@ int main(int argc, char ** argv) {
     char *f = argv[1];
     unsigned int bufsize = 0;
     char *buffer         = loadfile(f, &bufsize);
-    extractmeshes(buffer, bufsize, f);
+    extractmeshes(buffer, f, bufsize);
     free(buffer);
     return 0;
 }

include/devil1geo.h

@@ -105,7 +105,7 @@ static bool getmeshheader(struct MeshHeader**, unsigned int i, const char * cons
 
 static bool getmeshbatch(struct Batch*, unsigned int offset, const char * const);
 
-static bool getmesh(struct Mesh*, unsigned int i, const char* filename);
+static bool getmesh(struct Mesh*, unsigned int i, const char* filename, unsigned int filesize);
 
 #endif
 

src/devil1geo.c

@@ -100,7 +100,8 @@ static bool getmeshbatch(struct Batch *b,
 // assume client has allocated memory for mesh
 static bool getmesh(struct Mesh *m,
              unsigned int i,
-             const char * const filedata) {        
+             const char * const filedata,
+             unsigned int filesize) {
     bool done = false;
     if (m == NULL || filedata == NULL || m -> b == NULL) {
         return done;
@@ -112,6 +113,9 @@ static bool getmesh(struct Mesh *m,
         struct Batch b;
         for (j = 0; j < mh -> numBatch; j++) {
             unsigned int offset = mh->offsetBatches + j * sizeof(struct BatchData);
+            if (offset > filesize) {
+              return done;
+            }
             getmeshbatch(&b, offset, filedata);
 //            printmeshbatch(&b);
             m -> b[j] = b;

src/devil1pld.c

@@ -8,7 +8,9 @@ static bool getpldh(struct PldHeader *ph, const char *filedata) {
     if (ph != NULL && filedata != NULL) {
         ph -> numOffset = (int32_t)filedata[0];
         ph -> offsets   = (uint32_t*)(filedata + sizeof(int32_t));
-        good = true;
+        if ( ph->numOffset > 0 ) {
+          good = true;
+        }
     }
     return good;
 }

src/devil1tex.c

@@ -37,7 +37,7 @@ static bool gettexdescriptor(struct TextureBatchDescriptor **descriptor,
     bool done = false;
     unsigned int offset = sizeof(struct TexturePack);
     offset += sizeof(struct TextureBatchDescriptor) * i;
-    if (filedata != NULL) {
+    if (filedata != NULL && offset <= filesize) {
         *descriptor = (struct TextureBatchDescriptor*)(filedata + offset);
         done = true;
     }