engine: imagelib: img_png: validate image size through common engine function

common/com_image.h

@@ -49,6 +49,7 @@ typedef enum
 	IL_DDS_HARDWARE	= BIT(4),	// DXT compression is support
 	IL_LOAD_DECAL	= BIT(5),	// special mode for load gradient decals
 	IL_OVERVIEW	= BIT(6),	// overview required some unque operations
+	IL_LOAD_PLAYER_DECAL = BIT(7), // special mode for player decals
 } ilFlags_t;
 
 // goes into rgbdata_t->encode

engine/common/imagelib/img_png.c

@@ -82,8 +82,8 @@ qboolean Image_LoadPNG( const char *name, const byte *buffer, fs_offset_t filesi
 	}
 
 	// convert image width and height to little endian
-	png_hdr.ihdr_chunk.height = ntohl( png_hdr.ihdr_chunk.height );
-	png_hdr.ihdr_chunk.width = ntohl( png_hdr.ihdr_chunk.width );
+	image.height = png_hdr.ihdr_chunk.height = ntohl( png_hdr.ihdr_chunk.height );
+	image.width  = png_hdr.ihdr_chunk.width  = ntohl( png_hdr.ihdr_chunk.width );
 
 	if( png_hdr.ihdr_chunk.height == 0 || png_hdr.ihdr_chunk.width == 0 )
 	{
@@ -91,6 +91,9 @@ qboolean Image_LoadPNG( const char *name, const byte *buffer, fs_offset_t filesi
 		return false;
 	}
 
+	if( !Image_ValidSize( name ))
+		return false;
+
 	if( png_hdr.ihdr_chunk.bitdepth != 8 )
 	{
 		Con_DPrintf( S_WARN "Image_LoadPNG: Only 8-bit images is supported (%s)\n", name );
@@ -261,8 +264,6 @@ qboolean Image_LoadPNG( const char *name, const byte *buffer, fs_offset_t filesi
 	}
 
 	image.type = PF_RGBA_32; // always exctracted to 32-bit buffer
-	image.width = png_hdr.ihdr_chunk.width;
-	image.height = png_hdr.ihdr_chunk.height;
 	pixel_count = image.height * image.width;
 	image.size = pixel_count * 4;