@@ -139,19 +139,30 @@ static bool ReadHeightmapPNG(char *filen
ShowErrorMessage(STR_ERROR_PNGMAP, STR_ERROR_PNGMAP_IMAGE_TYPE, WL_ERROR);
fclose(fp);
png_destroy_read_struct(&png_ptr, &info_ptr, NULL);
return false;
}
uint width = png_get_image_width(png_ptr, info_ptr);
uint height = png_get_image_height(png_ptr, info_ptr);
/* Check if image dimensions don't overflow a size_t to avoid memory corruption. */
if ((uint64)width * height >= (size_t)-1) {
ShowErrorMessage(STR_ERROR_PNGMAP, STR_ERROR_HEIGHTMAP_TOO_LARGE, WL_ERROR);
if (map != NULL) {
*map = MallocT<byte>(png_get_image_width(png_ptr, info_ptr) * png_get_image_height(png_ptr, info_ptr));
*map = MallocT<byte>(width * height);
ReadHeightmapPNGImageData(*map, png_ptr, info_ptr);
*x = png_get_image_width(png_ptr, info_ptr);
*y = png_get_image_height(png_ptr, info_ptr);
*x = width;
*y = height;
return true;
@@ -240,12 +251,20 @@ static bool ReadHeightmapBMP(char *filen
ShowErrorMessage(STR_ERROR_BMPMAP, STR_ERROR_BMPMAP_IMAGE_TYPE, WL_ERROR);
fclose(f);
BmpDestroyData(&data);
if ((uint64)info.width * info.height >= (size_t)-1 / (info.bpp == 24 ? 3 : 1)) {
ShowErrorMessage(STR_ERROR_BMPMAP, STR_ERROR_HEIGHTMAP_TOO_LARGE, WL_ERROR);
if (!BmpReadBitmap(&buffer, &info, &data)) {
@@ -3449,12 +3449,14 @@ STR_ERROR_PNGMAP_FILE_NOT_FOUND
STR_ERROR_PNGMAP_IMAGE_TYPE :{WHITE}... could not convert image type. 8 or 24-bit PNG image needed
STR_ERROR_PNGMAP_MISC :{WHITE}... something just went wrong (probably corrupted file)
STR_ERROR_BMPMAP :{WHITE}Can't load landscape from BMP...
STR_ERROR_BMPMAP_IMAGE_TYPE :{WHITE}... could not convert image type
STR_ERROR_HEIGHTMAP_TOO_LARGE :{WHITE}... image is too large
STR_WARNING_HEIGHTMAP_SCALE_CAPTION :{WHITE}Scale warning
STR_WARNING_HEIGHTMAP_SCALE_MESSAGE :{YELLOW}Resizing source map too much is not recommended. Continue with the generation?
# Soundset messages
STR_WARNING_FALLBACK_SOUNDSET :{WHITE}Only a fallback sound set was found. If you want sounds, install a sound set via the content download system
@@ -105,20 +105,31 @@ static bool LoadPNG(SpriteLoader::Sprite
if (strcmp("x_offs", text_ptr[i].key) == 0) sprite->x_offs = strtol(text_ptr[i].text, NULL, 0);
if (strcmp("y_offs", text_ptr[i].key) == 0) sprite->y_offs = strtol(text_ptr[i].text, NULL, 0);
sprite->height = png_get_image_height(png_ptr, info_ptr);
sprite->width = png_get_image_width(png_ptr, info_ptr);
/* Check if sprite dimensions aren't larger than what is allowed in GRF-files. */
if (sprite->height > UINT8_MAX || sprite->width > UINT16_MAX) {
png_destroy_read_struct(&png_ptr, &info_ptr, &end_info);
sprite->AllocateData(sprite->width * sprite->height);
} else if (sprite->height != png_get_image_height(png_ptr, info_ptr) || sprite->width != png_get_image_width(png_ptr, info_ptr)) {
/* Make sure the mask image isn't larger than the sprite image. */
DEBUG(misc, 0, "Ignoring mask for SpriteID %d as it isn't the same dimension as the masked sprite", id);
bit_depth = png_get_bit_depth(png_ptr, info_ptr);
colour_type = png_get_color_type(png_ptr, info_ptr);
if (mask && (bit_depth != 8 || colour_type != PNG_COLOR_TYPE_PALETTE)) {
DEBUG(misc, 0, "Ignoring mask for SpriteID %d as it isn't a 8 bit palette image", id);
if (!mask) {
if (bit_depth == 16) png_set_strip_16(png_ptr);
Status change: