1 files changed, 31 insertions, 6 deletions

diff --git a/indra/llimage/llimagetga.cpp b/indra/llimage/llimagetga.cpp
index 7c75aa1e2a..88bdae9b80 100644
--- a/indra/llimage/llimagetga.cpp
+++ b/indra/llimage/llimagetga.cpp
@@ -263,7 +263,7 @@ bool LLImageTGA::updateData()
 		// only allocate memory for one if _we_ intend to use it.
 		if ( (1 == mImageType) || (9 == mImageType)  )
 		{
-			mColorMap = new U8[ color_map_bytes ];  
+			mColorMap = new(std::nothrow) U8[ color_map_bytes ];  
 			if (!mColorMap)
 			{
 				LL_ERRS() << "Out of Memory in bool LLImageTGA::updateData()" << LL_ENDL;
@@ -336,7 +336,11 @@ bool LLImageTGA::decode(LLImageRaw* raw_image, F32 decode_time)
 
 	// Copy everything after the header.
 
-	raw_image->resize(getWidth(), getHeight(), getComponents());
+	if( !raw_image->resize(getWidth(), getHeight(), getComponents()))
+	{
+		setLastError("LLImageTGA::out of memory");
+		return false;
+	}
 
 	if( (getComponents() != 1) &&
 		(getComponents() != 3) &&
@@ -346,6 +350,11 @@ bool LLImageTGA::decode(LLImageRaw* raw_image, F32 decode_time)
 		return false;
 	}
 
+	if( raw_image->isBufferInvalid())
+	{
+		setLastError("LLImageTGA::out of memory");
+		return false;
+	}
 
 	if( mOriginRightBit )
 	{
@@ -395,6 +404,11 @@ bool LLImageTGA::decodeTruecolor( LLImageRaw* raw_image, bool rle, bool flipped
 				// alpha was entirely opaque
 				// convert to 24 bit image
 				LLPointer<LLImageRaw> compacted_image = new LLImageRaw(raw_image->getWidth(), raw_image->getHeight(), 3);
+				if (compacted_image->isBufferInvalid())
+				{
+					success = false;
+					break;
+				}
 				compacted_image->copy(raw_image);
 				raw_image->resize(raw_image->getWidth(), raw_image->getHeight(), 3);
 				raw_image->copy(compacted_image);
@@ -411,9 +425,16 @@ bool LLImageTGA::decodeTruecolor( LLImageRaw* raw_image, bool rle, bool flipped
 			// alpha was entirely opaque
 			// convert to 24 bit image
 			LLPointer<LLImageRaw> compacted_image = new LLImageRaw(raw_image->getWidth(), raw_image->getHeight(), 3);
-			compacted_image->copy(raw_image);
-			raw_image->resize(raw_image->getWidth(), raw_image->getHeight(), 3);
-			raw_image->copy(compacted_image);
+			if (compacted_image->isBufferInvalid())
+			{
+				success = false;
+			}
+			else
+			{
+				compacted_image->copy(raw_image);
+				raw_image->resize(raw_image->getWidth(), raw_image->getHeight(), 3);
+				raw_image->copy(compacted_image);
+			}
 		}
 	}
 	
@@ -1053,7 +1074,11 @@ bool LLImageTGA::decodeAndProcess( LLImageRaw* raw_image, F32 domain, F32 weight
 		return false;
 	}
 
-	raw_image->resize(getWidth(), getHeight(), getComponents());
+	if( !raw_image->resize(getWidth(), getHeight(), getComponents()) )
+	{
+		LL_ERRS() << "LLImageTGA: Failed to resize image" << LL_ENDL;
+		return false;
+	}
 
 	U8* dst = raw_image->getData();
 	U8* src = getData() + mDataOffset;