diff --git a/src/p_dialog.c b/src/p_dialog.c index 7fbc3103cf445563792d56e953aa986590bb1da3..795a278bbe82d8fea11e37ff91bd7d3753315509 100644 --- a/src/p_dialog.c +++ b/src/p_dialog.c @@ -326,7 +326,9 @@ void P_SetDialogIcon(dialog_t *dialog, const char *icon) strlcpy(dialog->icon, icon, sizeof(dialog->icon)); - dialog->iconlump = W_CheckNumForLongName(icon); + lumpnum_t iconlump = W_CheckNumForLongName(icon); + if (iconlump != LUMPERROR && W_IsValidPatchNum(iconlump)) + dialog->iconlump = iconlump; } static void P_DialogGetDispText(char *disptext, const char *text, size_t length) diff --git a/src/r_picformats.c b/src/r_picformats.c index f93c9e7619fe1b34b80bc6862a3add28e0408d87..c81d9d12cbef5268a40586c0fa8cf6d01c68351f 100644 --- a/src/r_picformats.c +++ b/src/r_picformats.c @@ -703,16 +703,13 @@ boolean Picture_IsFlatFormat(pictureformat_t format) */ boolean Picture_CheckIfDoomPatch(softwarepatch_t *patch, size_t size) { - INT16 width, height; - boolean result; - // minimum length of a valid Doom patch if (size < 13) return false; - width = SHORT(patch->width); - height = SHORT(patch->height); - result = (height > 0 && height <= 16384 && width > 0 && width <= 16384); + INT16 width = SHORT(patch->width); + INT16 height = SHORT(patch->height); + boolean result = height > 0 && height <= 16384 && width > 0 && width <= 16384; if (result) { @@ -720,9 +717,7 @@ boolean Picture_CheckIfDoomPatch(softwarepatch_t *patch, size_t size) // check the column directory for extra security. All columns // must begin after the column directory, and none of them must // point past the end of the patch. - INT16 x; - - for (x = 0; x < width; x++) + for (INT16 x = 0; x < width; x++) { UINT32 ofs = LONG(patch->columnofs[x]); diff --git a/src/w_wad.c b/src/w_wad.c index f19f5b81b0226d23975343b3f8d9bec8312480e1..2767b8459311887b680b3ec33338370363cc26bf 100644 --- a/src/w_wad.c +++ b/src/w_wad.c @@ -2105,32 +2105,36 @@ void *W_CachePatchNum(lumpnum_t lumpnum, INT32 tag) return W_CachePatchNumPwad(WADFILENUM(lumpnum),LUMPNUM(lumpnum),tag); } +// Checks if a lump is a valid patch boolean W_IsValidPatchNumPwad(UINT16 wad, UINT16 lump) { if (!TestValidLump(wad, lump)) return false; - lumpcache_t *lumpcache = wadfiles[wad]->patchcache; - - // Probably is if it's loaded - if (lumpcache[lump]) + // Must be, if it's already loaded + if (wadfiles[wad]->patchcache[lump]) return true; - void *lumpdata = W_CacheLumpNumPwad(wad, lump, PU_CACHE); - if (!lumpdata) - return false; - size_t len = W_LumpLengthPwad(wad, lump); #ifndef NO_PNG_LUMPS - if (Picture_IsLumpPNG((UINT8 *)lumpdata, len)) + UINT8 png_header[PNG_HEADER_SIZE]; + + if (!W_ReadLumpHeaderPwad(wad, lump, png_header, PNG_HEADER_SIZE, 0)) + return false; + + if (Picture_IsLumpPNG(png_header, len)) { // Maybe it is? return true; } #endif - return Picture_CheckIfDoomPatch(lumpdata, len); + void *lumpdata = W_CacheLumpNumPwad(wad, lump, PU_CACHE); + if (lumpdata) + return Picture_CheckIfDoomPatch(lumpdata, len); + + return false; } boolean W_IsValidPatchNum(lumpnum_t lumpnum)