diff options
author | Kitty Barnett <develop@catznip.com> | 2017-10-12 22:55:15 +0200 |
---|---|---|
committer | Kitty Barnett <develop@catznip.com> | 2017-10-12 22:55:15 +0200 |
commit | 7d63a3fa5f4aa0b7529a1404fb43e9480e9f0cdf (patch) | |
tree | b82e36e680ea6b92d3b747da0533a80d5b3b6916 /indra/newview/llmaniprotate.cpp | |
parent | acf36ae8292257c501fdbd5e0a36b8903b66eb87 (diff) |
[FIXED] Access (write) violation / buffer overrun in LLTextureFetchWorker::doWork()
The trouble lines are:
U8 * buffer = (U8 *) ALLOCATE_MEM(LLImageBase::getPrivatePool(), total_size);
if (cur_size > 0)
{
memcpy(buffer, mFormattedImage->getData(), cur_size);
}
If 'cur_size > mHttpReplyOffset + append_size' then 'total_size -= src_offset' will cause
total_size to be smaller than cur_size causing a write access violation on the memcpy.
Since the response is invalid it seemed best to make it follow the other failed partial condition.
(transplanted from 737e28ec6b4d74f3ff915a4effc13d7b615a6a9b)
Diffstat (limited to 'indra/newview/llmaniprotate.cpp')
0 files changed, 0 insertions, 0 deletions