Proposals / #1684

DecodeSmacker: Stack[-0x71cc] is one 0x6db0-byte pixel buffer, not a single byte

checked · by Nishimura-Katsuo · submitted 2026-11-08

SBmpDecodeImage (0x006c6a80) is called at 0x006ba11b with dst = EBP-0x71c8 (Stack[-0x71cc]) and capacity 0x6db0. DecodePcxMem 0x006c6990 clamps the output to that capacity (0x006c69db..0x006c69f4). The caller then requires a 0x1d4 x 0x3c 8-bit image (468*60 = 0x6db0). The loop reads [ESI+EAX-1..+4] from ESI = EBP-0x71c7, walking bytes 0..0x6daf of the same buffer. The DB splits it into three 1-byte locals (aPixelData, aImagePixelData, aImagePixelDataPad), so the rebuild emits uint8_t aPixelData plus a separate uint8_t aImagePixelData[28079]. The decode then writes 28080 bytes into a 1-byte local, and the [-1] read assumes an adjacency gcc does not keep. Nothing else touches -0x71cb or -0x71ca, and the buffer ends where aPaletteRGBA starts (-0x41c). Please delete the two interior locals.

Changes 1, applied together

1. Retype variable win 0x006ba010 Stack[-0x71cc]

   typeundefined1→byte[28080]