more integer checks

git-svn-id: svn://svn.icculus.org/quake3/trunk@94 edf5b092-35ff-0310-97b2-ce42778d08ea

1 files changed, 8 insertions, 4 deletions

diff --git a/code/renderer/tr_image.c b/code/renderer/tr_image.c
index fdbd2f7..8094a16 100644
--- a/code/renderer/tr_image.c
+++ b/code/renderer/tr_image.c
@@ -821,7 +821,8 @@ typedef struct
 
 static void LoadBMP( const char *name, byte **pic, int *width, int *height )
 {
-	int		columns, rows, numPixels;
+	int		columns, rows;
+	unsigned	numPixels;
 	byte	*pixbuf;
 	int		row, column;
 	byte	*buf_p;
@@ -901,7 +902,8 @@ static void LoadBMP( const char *name, byte **pic, int *width, int *height )
 		rows = -rows;
 	numPixels = columns * rows;
 
-	if(!columns || !rows || numPixels > 0x1FFFFFFF) // 4*1FFFFFFF == 0x7FFFFFFC < 0x7FFFFFFF
+	if(columns <= 0 || !rows || numPixels > 0x1FFFFFFF // 4*1FFFFFFF == 0x7FFFFFFC < 0x7FFFFFFF
+	    || ((numPixels * 4) / columns) / 4 != rows)
 	{
 	  ri.Error (ERR_DROP, "LoadBMP: %s has an invalid image size\n", name);
 	}
@@ -1192,7 +1194,7 @@ static void LoadTGA ( const char *name, byte **pic, int *width, int *height)
 	if (height)
 		*height = rows;
 
-	if(!columns || !rows || numPixels > 0x7FFFFFFF)
+	if(!columns || !rows || numPixels > 0x7FFFFFFF || numPixels / columns / 4 != rows)
 	{
 		ri.Error (ERR_DROP, "LoadTGA: %s has an invalid image size\n", name);
 	}
@@ -1456,9 +1458,11 @@ static void LoadJPG( const char *filename, unsigned char **pic, int *width, int
 
 
   if(!cinfo.output_width || !cinfo.output_height
+      || ((pixelcount * 4) / cinfo.output_width) / 4 != cinfo.output_height
       || pixelcount > 0x1FFFFFFF || cinfo.output_components > 4) // 4*1FFFFFFF == 0x7FFFFFFC < 0x7FFFFFFF
   {
-    ri.Error (ERR_DROP, "LoadJPG: %s has an invalid image size\n", filename);
+    ri.Error (ERR_DROP, "LoadJPG: %s has an invalid image size: %dx%d*4=%d, components: %d\n", filename,
+		    cinfo.output_width, cinfo.output_height, pixelcount * 4, cinfo.output_components);
   }
 
   out = ri.Malloc(pixelcount * 4);