From 2df49c725f0f8caf4fb2461c20487eb29fb3244d Mon Sep 17 00:00:00 2001 From: Kelsi Date: Wed, 6 May 2026 06:29:26 -0700 Subject: [PATCH] fix(editor): texture exporter validates BLP image before passing to stbi Three new sanity checks before stbi_write_png: - dimensions <=0 or >8K rejected (matches PNG override loader cap) - data buffer must be >= width * height * 4 bytes (corrupt BLP could have mismatched dimensions vs data length, and stbi reads off the end of the buffer otherwise) Skips with warning rather than crashing the exporter mid-zone. --- tools/editor/texture_exporter.cpp | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/tools/editor/texture_exporter.cpp b/tools/editor/texture_exporter.cpp index c169c471..fb6de755 100644 --- a/tools/editor/texture_exporter.cpp +++ b/tools/editor/texture_exporter.cpp @@ -128,6 +128,20 @@ int TextureExporter::exportTexturesAsPng(pipeline::AssetManager* am, std::string fullPath = outputDir + "/" + outPath; fs::create_directories(fs::path(fullPath).parent_path()); + // Validate the loaded image before passing to stbi_write_png. A + // corrupt BLP could produce mismatched dimensions vs data length, + // and the data buffer needs to be at least width * height * 4 bytes. + const size_t expectedBytes = + static_cast(blpImage.width) * blpImage.height * 4; + if (blpImage.width <= 0 || blpImage.height <= 0 || + blpImage.width > 8192 || blpImage.height > 8192 || + blpImage.data.size() < expectedBytes) { + LOG_WARNING("PNG export skipped — invalid image (", + blpImage.width, "x", blpImage.height, + " data=", blpImage.data.size(), "): ", texPath); + continue; + } + // Write RGBA data as PNG if (stbi_write_png(fullPath.c_str(), blpImage.width, blpImage.height, 4, blpImage.data.data(), blpImage.width * 4)) {