summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJonathan Gordon <rockbox@jdgordon.info>2010-02-19 23:49:17 +0000
committerJonathan Gordon <rockbox@jdgordon.info>2010-02-19 23:49:17 +0000
commit90d9e66920f774582e4d5fbeed6b1ca0c5489c08 (patch)
treef9ef56245fe431e630d2564ca1ae71429b81a6cb
parent8b1bbdb0135d394c99f4ecbf987b715a03214630 (diff)
downloadrockbox-90d9e66920f774582e4d5fbeed6b1ca0c5489c08.tar.gz
rockbox-90d9e66920f774582e4d5fbeed6b1ca0c5489c08.zip
fix possible out-of-bounds error on remote lcd targets if they try loading a font to id==2
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@24779 a1c6a512-1295-4272-9138-f99709370657
-rw-r--r--apps/gui/skin_engine/skin_parser.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/apps/gui/skin_engine/skin_parser.c b/apps/gui/skin_engine/skin_parser.c
index fe68c7c57e..0a7dfd4075 100644
--- a/apps/gui/skin_engine/skin_parser.c
+++ b/apps/gui/skin_engine/skin_parser.c
@@ -692,6 +692,9 @@ static int parse_image_load(const char *wps_bufptr,
692 return skip_end_of_line(wps_bufptr); 692 return skip_end_of_line(wps_bufptr);
693} 693}
694 694
695/* this array acts as a simple mapping between the id the user uses for a font
696 * and the id the font actually gets from the font loader.
697 * font id 2 is always the first skin font (regardless of how many screens */
695static int font_ids[MAXUSERFONTS]; 698static int font_ids[MAXUSERFONTS];
696static int parse_font_load(const char *wps_bufptr, 699static int parse_font_load(const char *wps_bufptr,
697 struct wps_token *token, struct wps_data *wps_data) 700 struct wps_token *token, struct wps_data *wps_data)
@@ -715,7 +718,7 @@ static int parse_font_load(const char *wps_bufptr,
715 718
716 if (id <= FONT_UI || id >= MAXFONTS-1) 719 if (id <= FONT_UI || id >= MAXFONTS-1)
717 return WPS_ERROR_INVALID_PARAM; 720 return WPS_ERROR_INVALID_PARAM;
718 id -= SYSTEMFONTCOUNT; 721 id -= FONT_UI;
719 722
720 memcpy(buf, filename, ptr-filename); 723 memcpy(buf, filename, ptr-filename);
721 buf[ptr-filename] = '\0'; 724 buf[ptr-filename] = '\0';