Skip to content

Commit 1fbfbe7

Browse files
xezonxezon
authored
[GEN][ZH] Prevent dereferencing NULL pointer 'pbmi' and memory leaks in CreateBMPFile() (#1124)
1 parent d5e18c5 commit 1fbfbe7

File tree

2 files changed

+134
-130
lines changed
  • GeneralsMD/Code/GameEngineDevice/Source/W3DDevice/GameClient
  • Generals/Code/GameEngineDevice/Source/W3DDevice/GameClient

2 files changed

+134
-130
lines changed

‎Generals/Code/GameEngineDevice/Source/W3DDevice/GameClient/W3DDisplay.cpp

Lines changed: 67 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -2780,75 +2780,77 @@ void W3DDisplay::setShroudLevel( Int x, Int y, CellShroudStatus setting )
27802780
//=============================================================================
27812781
///Utility function to dump data into a .BMP file
27822782
static void CreateBMPFile(LPTSTR pszFile, char *image, Int width, Int height)
2783-
{
2784-
HANDLE hf; // file handle
2785-
BITMAPFILEHEADER hdr; // bitmap file-header
2786-
PBITMAPINFOHEADER pbih; // bitmap info-header
2787-
LPBYTE lpBits; // memory pointer
2788-
DWORD dwTotal; // total count of bytes
2789-
DWORD cb; // incremental count of bytes
2790-
BYTE *hp; // byte pointer
2791-
DWORD dwTmp;
2792-
2793-
PBITMAPINFO pbmi;
2794-
2795-
pbmi = (PBITMAPINFO) LocalAlloc(LPTR,sizeof(BITMAPINFOHEADER));
2796-
pbmi->bmiHeader.biSize = sizeof(BITMAPINFOHEADER);
2797-
pbmi->bmiHeader.biWidth = width;
2798-
pbmi->bmiHeader.biHeight = height;
2799-
pbmi->bmiHeader.biPlanes = 1;
2800-
pbmi->bmiHeader.biBitCount = 24;
2801-
pbmi->bmiHeader.biCompression = BI_RGB;
2802-
pbmi->bmiHeader.biSizeImage = (pbmi->bmiHeader.biWidth + 7) /8 * pbmi->bmiHeader.biHeight * 24;
2803-
pbmi->bmiHeader.biClrImportant = 0;
2804-
2805-
2806-
pbih = (PBITMAPINFOHEADER) pbmi;
2807-
lpBits = (LPBYTE) image;
2808-
2809-
// Create the .BMP file.
2810-
hf = CreateFile(pszFile,
2811-
GENERIC_READ | GENERIC_WRITE,
2812-
(DWORD) 0,
2813-
NULL,
2814-
CREATE_ALWAYS,
2815-
FILE_ATTRIBUTE_NORMAL,
2816-
(HANDLE) NULL);
2817-
if (hf == INVALID_HANDLE_VALUE)
2818-
return;
2819-
hdr.bfType = 0x4d42; // 0x42 = "B" 0x4d = "M"
2820-
// Compute the size of the entire file.
2821-
hdr.bfSize = (DWORD) (sizeof(BITMAPFILEHEADER) +
2822-
pbih->biSize + pbih->biClrUsed
2823-
* sizeof(RGBQUAD) + pbih->biSizeImage);
2824-
hdr.bfReserved1 = 0;
2825-
hdr.bfReserved2 = 0;
2826-
2827-
// Compute the offset to the array of color indices.
2828-
hdr.bfOffBits = (DWORD) sizeof(BITMAPFILEHEADER) +
2829-
pbih->biSize + pbih->biClrUsed
2830-
* sizeof (RGBQUAD);
2831-
2832-
// Copy the BITMAPFILEHEADER into the .BMP file.
2833-
if (!WriteFile(hf, (LPVOID) &hdr, sizeof(BITMAPFILEHEADER),
2834-
(LPDWORD) &dwTmp, NULL))
2835-
return;
2836-
2837-
// Copy the BITMAPINFOHEADER and RGBQUAD array into the file.
2838-
if (!WriteFile(hf, (LPVOID) pbih, sizeof(BITMAPINFOHEADER) + pbih->biClrUsed * sizeof (RGBQUAD),(LPDWORD) &dwTmp, NULL))
2783+
{
2784+
HANDLE hf; // file handle
2785+
BITMAPFILEHEADER hdr; // bitmap file-header
2786+
PBITMAPINFOHEADER pbih; // bitmap info-header
2787+
LPBYTE lpBits; // memory pointer
2788+
DWORD dwTotal; // total count of bytes
2789+
DWORD cb; // incremental count of bytes
2790+
BYTE *hp; // byte pointer
2791+
DWORD dwTmp;
2792+
2793+
PBITMAPINFO pbmi;
2794+
2795+
pbmi = (PBITMAPINFO) LocalAlloc(LPTR,sizeof(BITMAPINFOHEADER));
2796+
if (pbmi == NULL)
28392797
return;
28402798

2841-
// Copy the array of color indices into the .BMP file.
2842-
dwTotal = cb = pbih->biSizeImage;
2843-
hp = lpBits;
2844-
if (!WriteFile(hf, (LPSTR) hp, (int) cb, (LPDWORD) &dwTmp,NULL))
2845-
return;
2799+
pbmi->bmiHeader.biSize = sizeof(BITMAPINFOHEADER);
2800+
pbmi->bmiHeader.biWidth = width;
2801+
pbmi->bmiHeader.biHeight = height;
2802+
pbmi->bmiHeader.biPlanes = 1;
2803+
pbmi->bmiHeader.biBitCount = 24;
2804+
pbmi->bmiHeader.biCompression = BI_RGB;
2805+
pbmi->bmiHeader.biSizeImage = (pbmi->bmiHeader.biWidth + 7) /8 * pbmi->bmiHeader.biHeight * 24;
2806+
pbmi->bmiHeader.biClrImportant = 0;
2807+
2808+
pbih = (PBITMAPINFOHEADER) pbmi;
2809+
lpBits = (LPBYTE) image;
2810+
2811+
// Create the .BMP file.
2812+
hf = CreateFile(pszFile,
2813+
GENERIC_READ | GENERIC_WRITE,
2814+
(DWORD) 0,
2815+
NULL,
2816+
CREATE_ALWAYS,
2817+
FILE_ATTRIBUTE_NORMAL,
2818+
(HANDLE) NULL);
2819+
2820+
if (hf != INVALID_HANDLE_VALUE)
2821+
{
2822+
hdr.bfType = 0x4d42; // 0x42 = "B" 0x4d = "M"
2823+
// Compute the size of the entire file.
2824+
hdr.bfSize = (DWORD) (sizeof(BITMAPFILEHEADER) +
2825+
pbih->biSize + pbih->biClrUsed
2826+
* sizeof(RGBQUAD) + pbih->biSizeImage);
2827+
hdr.bfReserved1 = 0;
2828+
hdr.bfReserved2 = 0;
2829+
2830+
// Compute the offset to the array of color indices.
2831+
hdr.bfOffBits = (DWORD) sizeof(BITMAPFILEHEADER) +
2832+
pbih->biSize + pbih->biClrUsed
2833+
* sizeof (RGBQUAD);
2834+
2835+
// Copy the BITMAPFILEHEADER into the .BMP file.
2836+
if (WriteFile(hf, (LPVOID) &hdr, sizeof(BITMAPFILEHEADER),
2837+
(LPDWORD) &dwTmp, NULL))
2838+
{
2839+
// Copy the BITMAPINFOHEADER and RGBQUAD array into the file.
2840+
if (WriteFile(hf, (LPVOID) pbih, sizeof(BITMAPINFOHEADER) + pbih->biClrUsed * sizeof (RGBQUAD),(LPDWORD) &dwTmp, NULL))
2841+
{
2842+
// Copy the array of color indices into the .BMP file.
2843+
dwTotal = cb = pbih->biSizeImage;
2844+
hp = lpBits;
2845+
WriteFile(hf, (LPSTR) hp, (int) cb, (LPDWORD) &dwTmp, NULL);
2846+
}
2847+
}
28462848

2847-
// Close the .BMP file.
2848-
if (!CloseHandle(hf))
2849-
return;
2849+
// Close the .BMP file.
2850+
CloseHandle(hf);
2851+
}
28502852

2851-
// Free memory.
2853+
// Free memory.
28522854
LocalFree( (HLOCAL) pbmi);
28532855
}
28542856

‎GeneralsMD/Code/GameEngineDevice/Source/W3DDevice/GameClient/W3DDisplay.cpp

Lines changed: 67 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -2920,75 +2920,77 @@ void W3DDisplay::setShroudLevel( Int x, Int y, CellShroudStatus setting )
29202920
//=============================================================================
29212921
///Utility function to dump data into a .BMP file
29222922
static void CreateBMPFile(LPTSTR pszFile, char *image, Int width, Int height)
2923-
{
2924-
HANDLE hf; // file handle
2925-
BITMAPFILEHEADER hdr; // bitmap file-header
2926-
PBITMAPINFOHEADER pbih; // bitmap info-header
2927-
LPBYTE lpBits; // memory pointer
2928-
DWORD dwTotal; // total count of bytes
2929-
DWORD cb; // incremental count of bytes
2930-
BYTE *hp; // byte pointer
2931-
DWORD dwTmp;
2932-
2933-
PBITMAPINFO pbmi;
2934-
2935-
pbmi = (PBITMAPINFO) LocalAlloc(LPTR,sizeof(BITMAPINFOHEADER));
2936-
pbmi->bmiHeader.biSize = sizeof(BITMAPINFOHEADER);
2937-
pbmi->bmiHeader.biWidth = width;
2938-
pbmi->bmiHeader.biHeight = height;
2939-
pbmi->bmiHeader.biPlanes = 1;
2940-
pbmi->bmiHeader.biBitCount = 24;
2941-
pbmi->bmiHeader.biCompression = BI_RGB;
2942-
pbmi->bmiHeader.biSizeImage = (pbmi->bmiHeader.biWidth + 7) /8 * pbmi->bmiHeader.biHeight * 24;
2943-
pbmi->bmiHeader.biClrImportant = 0;
2944-
2945-
2946-
pbih = (PBITMAPINFOHEADER) pbmi;
2947-
lpBits = (LPBYTE) image;
2948-
2949-
// Create the .BMP file.
2950-
hf = CreateFile(pszFile,
2951-
GENERIC_READ | GENERIC_WRITE,
2952-
(DWORD) 0,
2953-
NULL,
2954-
CREATE_ALWAYS,
2955-
FILE_ATTRIBUTE_NORMAL,
2956-
(HANDLE) NULL);
2957-
if (hf == INVALID_HANDLE_VALUE)
2958-
return;
2959-
hdr.bfType = 0x4d42; // 0x42 = "B" 0x4d = "M"
2960-
// Compute the size of the entire file.
2961-
hdr.bfSize = (DWORD) (sizeof(BITMAPFILEHEADER) +
2962-
pbih->biSize + pbih->biClrUsed
2963-
* sizeof(RGBQUAD) + pbih->biSizeImage);
2964-
hdr.bfReserved1 = 0;
2965-
hdr.bfReserved2 = 0;
2966-
2967-
// Compute the offset to the array of color indices.
2968-
hdr.bfOffBits = (DWORD) sizeof(BITMAPFILEHEADER) +
2969-
pbih->biSize + pbih->biClrUsed
2970-
* sizeof (RGBQUAD);
2971-
2972-
// Copy the BITMAPFILEHEADER into the .BMP file.
2973-
if (!WriteFile(hf, (LPVOID) &hdr, sizeof(BITMAPFILEHEADER),
2974-
(LPDWORD) &dwTmp, NULL))
2975-
return;
2976-
2977-
// Copy the BITMAPINFOHEADER and RGBQUAD array into the file.
2978-
if (!WriteFile(hf, (LPVOID) pbih, sizeof(BITMAPINFOHEADER) + pbih->biClrUsed * sizeof (RGBQUAD),(LPDWORD) &dwTmp, NULL))
2923+
{
2924+
HANDLE hf; // file handle
2925+
BITMAPFILEHEADER hdr; // bitmap file-header
2926+
PBITMAPINFOHEADER pbih; // bitmap info-header
2927+
LPBYTE lpBits; // memory pointer
2928+
DWORD dwTotal; // total count of bytes
2929+
DWORD cb; // incremental count of bytes
2930+
BYTE *hp; // byte pointer
2931+
DWORD dwTmp;
2932+
2933+
PBITMAPINFO pbmi;
2934+
2935+
pbmi = (PBITMAPINFO) LocalAlloc(LPTR,sizeof(BITMAPINFOHEADER));
2936+
if (pbmi == NULL)
29792937
return;
29802938

2981-
// Copy the array of color indices into the .BMP file.
2982-
dwTotal = cb = pbih->biSizeImage;
2983-
hp = lpBits;
2984-
if (!WriteFile(hf, (LPSTR) hp, (int) cb, (LPDWORD) &dwTmp,NULL))
2985-
return;
2939+
pbmi->bmiHeader.biSize = sizeof(BITMAPINFOHEADER);
2940+
pbmi->bmiHeader.biWidth = width;
2941+
pbmi->bmiHeader.biHeight = height;
2942+
pbmi->bmiHeader.biPlanes = 1;
2943+
pbmi->bmiHeader.biBitCount = 24;
2944+
pbmi->bmiHeader.biCompression = BI_RGB;
2945+
pbmi->bmiHeader.biSizeImage = (pbmi->bmiHeader.biWidth + 7) /8 * pbmi->bmiHeader.biHeight * 24;
2946+
pbmi->bmiHeader.biClrImportant = 0;
2947+
2948+
pbih = (PBITMAPINFOHEADER) pbmi;
2949+
lpBits = (LPBYTE) image;
2950+
2951+
// Create the .BMP file.
2952+
hf = CreateFile(pszFile,
2953+
GENERIC_READ | GENERIC_WRITE,
2954+
(DWORD) 0,
2955+
NULL,
2956+
CREATE_ALWAYS,
2957+
FILE_ATTRIBUTE_NORMAL,
2958+
(HANDLE) NULL);
2959+
2960+
if (hf != INVALID_HANDLE_VALUE)
2961+
{
2962+
hdr.bfType = 0x4d42; // 0x42 = "B" 0x4d = "M"
2963+
// Compute the size of the entire file.
2964+
hdr.bfSize = (DWORD) (sizeof(BITMAPFILEHEADER) +
2965+
pbih->biSize + pbih->biClrUsed
2966+
* sizeof(RGBQUAD) + pbih->biSizeImage);
2967+
hdr.bfReserved1 = 0;
2968+
hdr.bfReserved2 = 0;
2969+
2970+
// Compute the offset to the array of color indices.
2971+
hdr.bfOffBits = (DWORD) sizeof(BITMAPFILEHEADER) +
2972+
pbih->biSize + pbih->biClrUsed
2973+
* sizeof (RGBQUAD);
2974+
2975+
// Copy the BITMAPFILEHEADER into the .BMP file.
2976+
if (WriteFile(hf, (LPVOID) &hdr, sizeof(BITMAPFILEHEADER),
2977+
(LPDWORD) &dwTmp, NULL))
2978+
{
2979+
// Copy the BITMAPINFOHEADER and RGBQUAD array into the file.
2980+
if (WriteFile(hf, (LPVOID) pbih, sizeof(BITMAPINFOHEADER) + pbih->biClrUsed * sizeof (RGBQUAD),(LPDWORD) &dwTmp, NULL))
2981+
{
2982+
// Copy the array of color indices into the .BMP file.
2983+
dwTotal = cb = pbih->biSizeImage;
2984+
hp = lpBits;
2985+
WriteFile(hf, (LPSTR) hp, (int) cb, (LPDWORD) &dwTmp, NULL);
2986+
}
2987+
}
29862988

2987-
// Close the .BMP file.
2988-
if (!CloseHandle(hf))
2989-
return;
2989+
// Close the .BMP file.
2990+
CloseHandle(hf);
2991+
}
29902992

2991-
// Free memory.
2993+
// Free memory.
29922994
LocalFree( (HLOCAL) pbmi);
29932995
}
29942996

0 commit comments

Comments
 (0)