#4 TGAReadColorMap, when tga->hdr.map_entry = 15 or 16

[g g]

Look at that code:

if (tga->hdr.map_entry == 15 || tga->hdr.map_entry == 16) {
n = read + read / 2;
*buf = (tbyte*)realloc(*buf, n);
if (!(*buf)) {
TGA_ERROR(tga, TGA_OOM);
return 0;
}

for(i = read - 1; i >= 0; i -= 2) {
tmp = *buf[i - 1] + *buf[i] * 255;
*buf[n - 2] = (tmp >> 10) & 0x1F;
*buf[n - 1] = (tmp >> 5) & 0x1F;
*buf[n] = (tmp >> 5) & 0x1F;
n -= 3;
}
}

You are allocating n bytes by using realloc, then you write *buf[n] byte, wchich is out of allocation range, valid bytes are [0..n-1], not [1..n]. Loop should look like this:

for(i = read - 1; i >= 0; i -= 2) {
tmp = *buf[i - 1] + *buf[i] * 255;
*buf[n - 3] = (tmp >> 10) & 0x1F;
*buf[n - 2] = (tmp >> 5) & 0x1F;
*buf[n - 1] = (tmp >> 5) & 0x1F;
n -= 3;
}

[Maarten]

Hey,
I forked this project on GitHub and fixed some bugs on the way.
I believe I fixed this bug.
The fork is at https://github.com/madebr/libtga.