diff options
Diffstat (limited to 'apps/gui')
-rw-r--r-- | apps/gui/skin_engine/skin_parser.c | 21 |
1 files changed, 17 insertions, 4 deletions
diff --git a/apps/gui/skin_engine/skin_parser.c b/apps/gui/skin_engine/skin_parser.c index 06b37d875c..a76a06ac61 100644 --- a/apps/gui/skin_engine/skin_parser.c +++ b/apps/gui/skin_engine/skin_parser.c | |||
@@ -922,30 +922,43 @@ static int parse_progressbar_tag(struct skin_element* element, | |||
922 | 922 | ||
923 | /* (x, y, width, height, ...) */ | 923 | /* (x, y, width, height, ...) */ |
924 | if (!isdefault(param)) | 924 | if (!isdefault(param)) |
925 | { | ||
925 | pb->x = param->data.number; | 926 | pb->x = param->data.number; |
927 | if (pb->x < 0 || pb->x >= vp->width) | ||
928 | return WPS_ERROR_INVALID_PARAM; | ||
929 | } | ||
926 | else | 930 | else |
927 | pb->x = 0; | 931 | pb->x = 0; |
928 | param++; | 932 | param++; |
929 | 933 | ||
930 | if (!isdefault(param)) | 934 | if (!isdefault(param)) |
935 | { | ||
931 | pb->y = param->data.number; | 936 | pb->y = param->data.number; |
937 | if (pb->y < 0 || pb->y >= vp->height) | ||
938 | return WPS_ERROR_INVALID_PARAM; | ||
939 | } | ||
932 | else | 940 | else |
933 | pb->y = -1; /* computed at rendering */ | 941 | pb->y = -1; /* computed at rendering */ |
934 | param++; | 942 | param++; |
935 | 943 | ||
936 | if (!isdefault(param)) | 944 | if (!isdefault(param)) |
945 | { | ||
937 | pb->width = param->data.number; | 946 | pb->width = param->data.number; |
947 | if (pb->width <= 0 || (pb->x + pb->width) > vp->width) | ||
948 | return WPS_ERROR_INVALID_PARAM; | ||
949 | } | ||
938 | else | 950 | else |
939 | pb->width = vp->width - pb->x; | 951 | pb->width = vp->width - pb->x; |
940 | param++; | 952 | param++; |
941 | 953 | ||
942 | if (!isdefault(param)) | 954 | if (!isdefault(param)) |
943 | { | 955 | { |
944 | /* A zero height makes no sense - reject it */ | 956 | int max; |
945 | if (param->data.number == 0) | ||
946 | return WPS_ERROR_INVALID_PARAM; | ||
947 | |||
948 | pb->height = param->data.number; | 957 | pb->height = param->data.number; |
958 | /* include y in check only if it was non-default */ | ||
959 | max = (pb->y > 0) ? pb->y + pb->height : pb->height; | ||
960 | if (pb->height <= 0 || max > vp->height) | ||
961 | return WPS_ERROR_INVALID_PARAM; | ||
949 | } | 962 | } |
950 | else | 963 | else |
951 | { | 964 | { |