diff --git a/Common/Data/Format/PNGLoad.cpp b/Common/Data/Format/PNGLoad.cpp index 6f843ba319..7294d049dd 100644 --- a/Common/Data/Format/PNGLoad.cpp +++ b/Common/Data/Format/PNGLoad.cpp @@ -148,8 +148,12 @@ bool PNGHeaderPeek::IsValidPNGHeader() const { if (magic != 0x474e5089 || ihdrTag != 0x52444849) { return false; } - // Reject crazy sized images, too. - if (Width() > 32768 && Height() > 32768) { + // Keep the peeker's limit consistent with pngLoadPtr(). A replacement + // texture is decoded into an uncompressed RGBA buffer, so accepting one + // oversized dimension would still allow a decompression bomb. + const int width = Width(); + const int height = Height(); + if (width <= 0 || height <= 0 || width > 8192 || height > 8192) { return false; } return true; diff --git a/GPU/Common/ReplacedTexture.cpp b/GPU/Common/ReplacedTexture.cpp index 0b8b7f2d00..79c1c80e21 100644 --- a/GPU/Common/ReplacedTexture.cpp +++ b/GPU/Common/ReplacedTexture.cpp @@ -721,7 +721,6 @@ ReplacedTexture::LoadLevelResult ReplacedTexture::LoadLevelData(VFSFileReference png.format = PNG_FORMAT_RGBA; std::vector &out = data_[mipLevel]; - // TODO: Should probably try to handle out-of-memory gracefully here. out.resize(level.w * level.h * 4); if (!png_image_finish_read(&png, nullptr, &out[0], level.w * 4, nullptr)) { ERROR_LOG(Log::TexReplacement, "Could not load texture replacement: %s - %s", filename.c_str(), png.message);