Comment 2 for bug 1646971

Revision history for this message
rdb (rdb) wrote :

Yeah, I see it. Strings in .bam are length-prefixed, so by modifying the string but not the length, all the texture fields it is reading got offset, including the one containing the texture image size. So it tries to allocate a ridiculous number of bytes.

It is easy to protect against allocating more than is actually contained within the file, so I'll add a check.