You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
PalettedBlockArray::fromData() now performs validation of the provided offset table (words) to ensure that no offset value points to an uninitialized or invalid palette offset. This was mainly a problem with corrupted data loaded from disk, where the palette for a block array was truncated for some reason.
Fixes various uninitialized values being returned in cases where offsets pointed outside of the palette.
Fixes a bug in 16 bpb that caused memory corruption outside the bounds of the palette when writing a block while the palette was already full. This happened because 16 bits can represent up to 65536 offsets, but the palette size is hard-capped at 4096. When 16 bpb has used all 4096 palette entries, the one used for the replaced block is directly overwritten without validating the offset.