r87 - trunk/code/renderer

[DONOTREPLY at icculus.org]

Author: icculus
Date: 2005-09-07 14:29:03 -0400 (Wed, 07 Sep 2005)
New Revision: 87

Modified:
   trunk/code/renderer/tr_image.c
Log:
Fixed buffer overflow in JPG decoder (thanks, Thilo Schulz!)

Modified: trunk/code/renderer/tr_image.c
===================================================================
--- trunk/code/renderer/tr_image.c	2005-09-07 11:44:13 UTC (rev 86)
+++ trunk/code/renderer/tr_image.c	2005-09-07 18:29:03 UTC (rev 87)
@@ -1438,10 +1438,14 @@
    * In this example, we need to make an output work buffer of the right size.
    */ 
   /* JSAMPLEs per row in output buffer */
-  row_stride = cinfo.output_width * cinfo.output_components;
 
-  out = ri.Malloc(cinfo.output_width*cinfo.output_height*cinfo.output_components);
+  // This row_stride from libjpeg's example code doesn't work, since we
+  //  want to fill in an alpha channel ourselves and jpegs might be 8-bit.
+  //row_stride = cinfo.output_width * cinfo.output_components;
+  row_stride = cinfo.output_width * 4;
+  out = ri.Malloc(row_stride*cinfo.output_height);
 
+
   *pic = out;
   *width = cinfo.output_width;
   *height = cinfo.output_height;