diff options
Diffstat (limited to 'apps')
-rw-r--r-- | apps/gui/wps_parser.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/apps/gui/wps_parser.c b/apps/gui/wps_parser.c index d5e29f3a4f..9327e89859 100644 --- a/apps/gui/wps_parser.c +++ b/apps/gui/wps_parser.c | |||
@@ -443,6 +443,10 @@ static int parse_image_display(const char *wps_bufptr, | |||
443 | 443 | ||
444 | if ((subimage = get_image_id(wps_bufptr[1])) != -1) | 444 | if ((subimage = get_image_id(wps_bufptr[1])) != -1) |
445 | { | 445 | { |
446 | /* Sanity check */ | ||
447 | if (subimage >= wps_data->img[n].num_subimages) | ||
448 | return WPS_ERROR_INVALID_PARAM; | ||
449 | |||
446 | /* Store sub-image number to display in high bits */ | 450 | /* Store sub-image number to display in high bits */ |
447 | token->value.i = n | (subimage << 8); | 451 | token->value.i = n | (subimage << 8); |
448 | return 2; /* We have consumed 2 bytes */ | 452 | return 2; /* We have consumed 2 bytes */ |
@@ -1382,7 +1386,7 @@ static void load_wps_bitmaps(struct wps_data *wps_data, char *bmpdir) | |||
1382 | *loaded = true; | 1386 | *loaded = true; |
1383 | 1387 | ||
1384 | /* Calculate and store height if this image has sub-images */ | 1388 | /* Calculate and store height if this image has sub-images */ |
1385 | if (n < MAX_IMAGES) | 1389 | if (n < MAX_IMAGES) |
1386 | wps_data->img[n].subimage_height = wps_data->img[n].bm.height / | 1390 | wps_data->img[n].subimage_height = wps_data->img[n].bm.height / |
1387 | wps_data->img[n].num_subimages; | 1391 | wps_data->img[n].num_subimages; |
1388 | } | 1392 | } |