diff --git a/src/TextScr.cpp b/src/TextScr.cpp index d7d6fe00..676422e9 100644 --- a/src/TextScr.cpp +++ b/src/TextScr.cpp @@ -167,6 +167,13 @@ BOOL LoadTextScript_Stage(const char *name) if (head_size == INVALID_FILE_SIZE) return FALSE; +#ifdef FIX_BUGS + // The original doesn't check for any kind of buffer overflow here, so feeding in a 1 MiB Head.tsc + // (assuming an unchanged TSC_BUFFER_SIZE) would be sure to crash the game, for example. + if (head_size > TSC_BUFFER_SIZE) + return FALSE; +#endif + fp = fopen(path, "rb"); if (fp == NULL) return FALSE; @@ -184,6 +191,12 @@ BOOL LoadTextScript_Stage(const char *name) if (body_size == INVALID_FILE_SIZE) return FALSE; +#ifdef FIX_BUGS + // Same as above: the original doesn't bother checking, and may crash on large-enough input + if (head_size + body_size > TSC_BUFFER_SIZE) + return FALSE; +#endif + fp = fopen(path, "rb"); if (fp == NULL) return FALSE;