Skip to content

Fix CMAP palette bounds in Amiga ILBM decoder#116

Merged
segrax merged 1 commit into
masterfrom
codex/fix-palette-overflow-in-ilbm-parser
May 24, 2026
Merged

Fix CMAP palette bounds in Amiga ILBM decoder#116
segrax merged 1 commit into
masterfrom
codex/fix-palette-overflow-in-ilbm-parser

Conversation

@segrax

@segrax segrax commented May 24, 2026

Copy link
Copy Markdown
Member

Motivation

  • Prevent an out-of-bounds write when decoding ILBM CMAP chunks into the fixed 256-entry sImage::mPalette which could be triggered by crafted/oversized CMAP chunks in attacker-controlled assets.

Description

  • Add a bounds check (if (i < 256)) around writes to Result.mPalette[i] in Source/Amiga/Graphics_Amiga.cpp::DecodeIFF while continuing to consume CMAP bytes so parsing behavior for valid assets is preserved.

Testing

  • Ran git diff -- Source/Amiga/Graphics_Amiga.cpp && git status --short to verify the change and it reported the expected diff; the command succeeded.
  • Committed the change with git add Source/Amiga/Graphics_Amiga.cpp && git commit -m "Fix CMAP palette bounds in Amiga ILBM decoder" and the commit succeeded.
  • Inspected the patched lines with nl -ba Source/Amiga/Graphics_Amiga.cpp | sed -n '600,635p' to confirm the bounds check is present and that command succeeded.

Codex Task

@segrax segrax merged commit b7e31c7 into master May 24, 2026
2 of 6 checks passed
@segrax segrax deleted the codex/fix-palette-overflow-in-ilbm-parser branch May 24, 2026 02:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant