diff options
author | Dave Chapman <dave@dchapman.com> | 2008-03-24 00:03:05 +0000 |
---|---|---|
committer | Dave Chapman <dave@dchapman.com> | 2008-03-24 00:03:05 +0000 |
commit | 99c0978faa94b0e2fabe5d06000a10c8d48e7a0c (patch) | |
tree | c86317bb69ca9baea5a67a6f2b30e94eaea831a1 /apps/gui | |
parent | 1644404fdd99ece8b89fd7cc76e7d4c271d18e0b (diff) | |
download | rockbox-99c0978faa94b0e2fabe5d06000a10c8d48e7a0c.tar.gz rockbox-99c0978faa94b0e2fabe5d06000a10c8d48e7a0c.zip |
Add a sanity-check to ensure only in-range subimages are referenced in %xd tags. Plus some tab policing.
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@16774 a1c6a512-1295-4272-9138-f99709370657
Diffstat (limited to 'apps/gui')
-rw-r--r-- | apps/gui/wps_parser.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/apps/gui/wps_parser.c b/apps/gui/wps_parser.c index d5e29f3a4f..9327e89859 100644 --- a/apps/gui/wps_parser.c +++ b/apps/gui/wps_parser.c | |||
@@ -443,6 +443,10 @@ static int parse_image_display(const char *wps_bufptr, | |||
443 | 443 | ||
444 | if ((subimage = get_image_id(wps_bufptr[1])) != -1) | 444 | if ((subimage = get_image_id(wps_bufptr[1])) != -1) |
445 | { | 445 | { |
446 | /* Sanity check */ | ||
447 | if (subimage >= wps_data->img[n].num_subimages) | ||
448 | return WPS_ERROR_INVALID_PARAM; | ||
449 | |||
446 | /* Store sub-image number to display in high bits */ | 450 | /* Store sub-image number to display in high bits */ |
447 | token->value.i = n | (subimage << 8); | 451 | token->value.i = n | (subimage << 8); |
448 | return 2; /* We have consumed 2 bytes */ | 452 | return 2; /* We have consumed 2 bytes */ |
@@ -1382,7 +1386,7 @@ static void load_wps_bitmaps(struct wps_data *wps_data, char *bmpdir) | |||
1382 | *loaded = true; | 1386 | *loaded = true; |
1383 | 1387 | ||
1384 | /* Calculate and store height if this image has sub-images */ | 1388 | /* Calculate and store height if this image has sub-images */ |
1385 | if (n < MAX_IMAGES) | 1389 | if (n < MAX_IMAGES) |
1386 | wps_data->img[n].subimage_height = wps_data->img[n].bm.height / | 1390 | wps_data->img[n].subimage_height = wps_data->img[n].bm.height / |
1387 | wps_data->img[n].num_subimages; | 1391 | wps_data->img[n].num_subimages; |
1388 | } | 1392 | } |