From 7d63a3fa5f4aa0b7529a1404fb43e9480e9f0cdf Mon Sep 17 00:00:00 2001 From: Kitty Barnett Date: Thu, 12 Oct 2017 22:55:15 +0200 Subject: [FIXED] Access (write) violation / buffer overrun in LLTextureFetchWorker::doWork() The trouble lines are: U8 * buffer = (U8 *) ALLOCATE_MEM(LLImageBase::getPrivatePool(), total_size); if (cur_size > 0) { memcpy(buffer, mFormattedImage->getData(), cur_size); } If 'cur_size > mHttpReplyOffset + append_size' then 'total_size -= src_offset' will cause total_size to be smaller than cur_size causing a write access violation on the memcpy. Since the response is invalid it seemed best to make it follow the other failed partial condition. (transplanted from 737e28ec6b4d74f3ff915a4effc13d7b615a6a9b) --- indra/newview/lltexturefetch.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'indra/newview') diff --git a/indra/newview/lltexturefetch.cpp b/indra/newview/lltexturefetch.cpp index b78d0b51d5..64ff59f6a6 100644 --- a/indra/newview/lltexturefetch.cpp +++ b/indra/newview/lltexturefetch.cpp @@ -1746,7 +1746,7 @@ bool LLTextureFetchWorker::doWork(S32 param) // In case of a partial response, our offset may // not be trivially contiguous with the data we have. // Get back into alignment. - if (mHttpReplyOffset > cur_size) + if ( (mHttpReplyOffset > cur_size) || (cur_size > mHttpReplyOffset + append_size)) { LL_WARNS(LOG_TXT) << "Partial HTTP response produces break in image data for texture " << mID << ". Aborting load." << LL_ENDL; -- cgit v1.2.3