diff options
| author | cinap_lenrek <cinap_lenrek@gmx.de> | 2013-06-16 19:01:46 +0200 |
|---|---|---|
| committer | cinap_lenrek <cinap_lenrek@gmx.de> | 2013-06-16 19:01:46 +0200 |
| commit | 202be57bb94b2bd65db9164bfd94ad2ec5167071 (patch) | |
| tree | a3e9b3e1911dc04058d0a6b320da1763a2919cae /sys/src/libdraw | |
| parent | e36d9f5c4e667970a4a7aa15744e304ccc7c58f3 (diff) | |
draw: add badrect() function to reject zero, negative size or orverly huge rectangles
not checking the rectangle dimensions causes integer overflows
and memory corruption. adding a new badrect() function that checks
for these cases.
Diffstat (limited to 'sys/src/libdraw')
| -rw-r--r-- | sys/src/libdraw/alloc.c | 4 | ||||
| -rw-r--r-- | sys/src/libdraw/badrect.c | 22 | ||||
| -rw-r--r-- | sys/src/libdraw/mkfile | 1 |
3 files changed, 27 insertions, 0 deletions
diff --git a/sys/src/libdraw/alloc.c b/sys/src/libdraw/alloc.c index 7884321ac..256378f36 100644 --- a/sys/src/libdraw/alloc.c +++ b/sys/src/libdraw/alloc.c @@ -26,6 +26,10 @@ _allocimage(Image *ai, Display *d, Rectangle r, ulong chan, int repl, ulong val, err = 0; i = 0; + if(badrect(r)){ + werrstr("bad rectangle"); + return nil; + } if(chan == 0){ werrstr("bad channel descriptor"); return nil; diff --git a/sys/src/libdraw/badrect.c b/sys/src/libdraw/badrect.c new file mode 100644 index 000000000..5ec53edb4 --- /dev/null +++ b/sys/src/libdraw/badrect.c @@ -0,0 +1,22 @@ +#include <u.h> +#include <libc.h> +#include <draw.h> + +/* + * check for zero, negative size or insanely huge rectangle. + */ +int +badrect(Rectangle r) +{ + int x, y; + uint z; + + x = Dx(r); + y = Dy(r); + if(x > 0 && y > 0){ + z = x*y; + if(z/x == y && z < 0x10000000) + return 0; + } + return 1; +} diff --git a/sys/src/libdraw/mkfile b/sys/src/libdraw/mkfile index 0a70c3a48..ef76b522b 100644 --- a/sys/src/libdraw/mkfile +++ b/sys/src/libdraw/mkfile @@ -6,6 +6,7 @@ OFILES=\ alloc.$O\ allocimagemix.$O\ arith.$O\ + badrect.$O\ bezier.$O\ border.$O\ buildfont.$O\ |