Merge pull request #22239 from acts-1631/security/fix-png-replacement-limits

Bound replacement PNG dimensions safely

Common/Data/Format/PNGLoad.cpp

@@ -148,8 +148,12 @@ bool PNGHeaderPeek::IsValidPNGHeader() const {
 	if (magic != 0x474e5089 || ihdrTag != 0x52444849) {
 		return false;
 	}
-	// Reject crazy sized images, too.
-	if (Width() > 32768 && Height() > 32768) {
+	// Keep the peeker's limit consistent with pngLoadPtr(). A replacement
+	// texture is decoded into an uncompressed RGBA buffer, so accepting one
+	// oversized dimension would still allow a decompression bomb.
+	const int width = Width();
+	const int height = Height();
+	if (width <= 0 || height <= 0 || width > 8192 || height > 8192) {
 		return false;
 	}
 	return true;

GPU/Common/ReplacedTexture.cpp

@@ -721,7 +721,6 @@ ReplacedTexture::LoadLevelResult ReplacedTexture::LoadLevelData(VFSFileReference
 		png.format = PNG_FORMAT_RGBA;
 
 		std::vector<uint8_t> &out = data_[mipLevel];
-		// TODO: Should probably try to handle out-of-memory gracefully here.
 		out.resize(level.w * level.h * 4);
 		if (!png_image_finish_read(&png, nullptr, &out[0], level.w * 4, nullptr)) {
 			ERROR_LOG(Log::TexReplacement, "Could not load texture replacement: %s - %s", filename.c_str(), png.message);