diff options
| author | cinap_lenrek <cinap_lenrek@gmx.de> | 2013-06-16 19:01:46 +0200 |
|---|---|---|
| committer | cinap_lenrek <cinap_lenrek@gmx.de> | 2013-06-16 19:01:46 +0200 |
| commit | 202be57bb94b2bd65db9164bfd94ad2ec5167071 (patch) | |
| tree | a3e9b3e1911dc04058d0a6b320da1763a2919cae /sys/src/libmemdraw/draw.c | |
| parent | e36d9f5c4e667970a4a7aa15744e304ccc7c58f3 (diff) | |
draw: add badrect() function to reject zero, negative size or orverly huge rectangles
not checking the rectangle dimensions causes integer overflows
and memory corruption. adding a new badrect() function that checks
for these cases.
Diffstat (limited to 'sys/src/libmemdraw/draw.c')
| -rw-r--r-- | sys/src/libmemdraw/draw.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/src/libmemdraw/draw.c b/sys/src/libmemdraw/draw.c index 9416e0059..5a15e4dae 100644 --- a/sys/src/libmemdraw/draw.c +++ b/sys/src/libmemdraw/draw.c @@ -228,7 +228,7 @@ drawclip(Memimage *dst, Rectangle *r, Memimage *src, Point *p0, Memimage *mask, int splitcoords; Rectangle omr; - if(r->min.x>=r->max.x || r->min.y>=r->max.y) + if(badrect(*r)) return 0; splitcoords = (p0->x!=p1->x) || (p0->y!=p1->y); /* clip to destination */ |