Skip to content

Clamp Amiga palette copy size to destination capacity#115

Merged
segrax merged 1 commit into
masterfrom
codex/propose-fix-for-amiga-iff-palette-vulnerability
May 24, 2026
Merged

Clamp Amiga palette copy size to destination capacity#115
segrax merged 1 commit into
masterfrom
codex/propose-fix-for-amiga-iff-palette-vulnerability

Conversation

@segrax
Copy link
Copy Markdown
Member

@segrax segrax commented May 24, 2026

Motivation

  • Prevent memory corruption when parsing Amiga IFF/BMHD images where the file-controlled mPlanes value can cause an oversized palette copy into the fixed-size Amiga palette.

Description

  • In Source/Amiga/Graphics_Amiga.cpp replace the unchecked Decoded.CopyPalette(mPalette, (1 << Decoded.mPlanes)) with a safe calculation that computes PaletteCapacity = sizeof(mPalette)/sizeof(mPalette[0]), guards the left shift width, derives RequestedColors from Decoded.mPlanes, and calls Decoded.CopyPalette(mPalette, std::min(RequestedColors, PaletteCapacity)) to clamp the copy size to the destination capacity.

Testing

  • Ran git diff --check to validate the patch formatting and it completed with no issues.

Codex Task

@segrax segrax merged commit 8bd0376 into master May 24, 2026
6 checks passed
@segrax segrax deleted the codex/propose-fix-for-amiga-iff-palette-vulnerability branch May 24, 2026 02:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant