diff options
| author | cinap_lenrek <cinap_lenrek@gmx.de> | 2013-06-16 19:01:46 +0200 |
|---|---|---|
| committer | cinap_lenrek <cinap_lenrek@gmx.de> | 2013-06-16 19:01:46 +0200 |
| commit | 202be57bb94b2bd65db9164bfd94ad2ec5167071 (patch) | |
| tree | a3e9b3e1911dc04058d0a6b320da1763a2919cae /sys/src/libmemdraw/load.c | |
| parent | e36d9f5c4e667970a4a7aa15744e304ccc7c58f3 (diff) | |
draw: add badrect() function to reject zero, negative size or orverly huge rectangles
not checking the rectangle dimensions causes integer overflows
and memory corruption. adding a new badrect() function that checks
for these cases.
Diffstat (limited to 'sys/src/libmemdraw/load.c')
| -rw-r--r-- | sys/src/libmemdraw/load.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/src/libmemdraw/load.c b/sys/src/libmemdraw/load.c index 984efa958..9c17eb01b 100644 --- a/sys/src/libmemdraw/load.c +++ b/sys/src/libmemdraw/load.c @@ -10,7 +10,7 @@ loadmemimage(Memimage *i, Rectangle r, uchar *data, int ndata) Memdrawparam par; uchar *q; - if(!rectinrect(r, i->r)) + if(badrect(r) || !rectinrect(r, i->r)) return -1; memset(&par, 0, sizeof par); |