mirrors/raylib
1
0
Fork 0
mirror of https://github.com/raysan5/raylib.git synced 2025-09-15 07:48:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

REVIEWED: Avoid realloc() calls, small security improvement

Browse Source
This commit is contained in:
Ray
2025-09-01 20:37:23 +02:00
parent 6226abb0d3
commit 1777da9056
4 changed files with 39 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/rcore.c
View File

@@ -2562,19 +2562,20 @@ unsigned char *DecompressData(const unsigned char *compData, int compDataSize, i
#if defined(SUPPORT_COMPRESSION_API)
// Decompress data from a valid DEFLATE stream
data = (unsigned char *)RL_CALLOC(MAX_DECOMPRESSION_SIZE*1024*1024, 1);
unsigned char *data0 = (unsigned char *)RL_CALLOC(MAX_DECOMPRESSION_SIZE*1024*1024, 1);
int length = sinflate(data, MAX_DECOMPRESSION_SIZE*1024*1024, compData, compDataSize);
// WARNING: RL_REALLOC can make (and leave) data copies in memory, be careful with sensitive compressed data!
// TODO: Use a different approach, create another buffer, copy data manually to it and wipe original buffer memory
unsigned char *temp = (unsigned char *)RL_REALLOC(data, length);
if (temp != NULL) data = temp;
else TRACELOG(LOG_WARNING, "SYSTEM: Failed to re-allocate required decompression memory");
// WARNING: RL_REALLOC can make (and leave) data copies in memory,
// that can be a security concern in case of compression of sensitive data
// So, we use a second buffer to copy data manually, wiping original buffer memory
data = (unsigned char *)RL_CALLOC(length, 1);
memcpy(data, data0, length);
memset(data0, 0, MAX_DECOMPRESSION_SIZE*1024*1024); // Wipe memory, is memset() safe?
RL_FREE(data0);
TRACELOG(LOG_INFO, "SYSTEM: Decompress data: Comp. size: %i -> Original size: %i", compDataSize, length);
*dataSize = length;
TRACELOG(LOG_INFO, "SYSTEM: Decompress data: Comp. size: %i -> Original size: %i", compDataSize, *dataSize);
#endif
return data;