diff options
| author | cinap_lenrek <cinap_lenrek@gmx.de> | 2013-06-16 19:01:46 +0200 |
|---|---|---|
| committer | cinap_lenrek <cinap_lenrek@gmx.de> | 2013-06-16 19:01:46 +0200 |
| commit | 202be57bb94b2bd65db9164bfd94ad2ec5167071 (patch) | |
| tree | a3e9b3e1911dc04058d0a6b320da1763a2919cae /sys/src/libdraw/alloc.c | |
| parent | e36d9f5c4e667970a4a7aa15744e304ccc7c58f3 (diff) | |
draw: add badrect() function to reject zero, negative size or orverly huge rectangles
not checking the rectangle dimensions causes integer overflows
and memory corruption. adding a new badrect() function that checks
for these cases.
Diffstat (limited to 'sys/src/libdraw/alloc.c')
| -rw-r--r-- | sys/src/libdraw/alloc.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/src/libdraw/alloc.c b/sys/src/libdraw/alloc.c index 7884321ac..256378f36 100644 --- a/sys/src/libdraw/alloc.c +++ b/sys/src/libdraw/alloc.c @@ -26,6 +26,10 @@ _allocimage(Image *ai, Display *d, Rectangle r, ulong chan, int repl, ulong val, err = 0; i = 0; + if(badrect(r)){ + werrstr("bad rectangle"); + return nil; + } if(chan == 0){ werrstr("bad channel descriptor"); return nil; |