From 0b11d983e7da48f762b51234bc6d65f7a7428465 Mon Sep 17 00:00:00 2001 From: Peter D'Hoye Date: Wed, 18 Apr 2007 21:13:08 +0000 Subject: Rockpaint plugin: protect against loading bitmaps that are too big. Fixes FS #7040 git-svn-id: svn://svn.rockbox.org/rockbox/trunk@13204 a1c6a512-1295-4272-9138-f99709370657 --- apps/plugins/rockpaint.c | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-) (limited to 'apps/plugins') diff --git a/apps/plugins/rockpaint.c b/apps/plugins/rockpaint.c index 68a3e5f595..a15d7b1141 100644 --- a/apps/plugins/rockpaint.c +++ b/apps/plugins/rockpaint.c @@ -2903,25 +2903,28 @@ static int load_bitmap( char *file ) { struct bitmap bm; bool ret; + int l; + bm.data = (char*)save_buffer; ret = rb->read_bmp_file( file, &bm, ROWS*COLS*sizeof( fb_data ), - FORMAT_NATIVE ); - if( bm.width < COLS ) + FORMAT_NATIVE ); + + if((bm.width > COLS ) || ( bm.height > ROWS )) + return -1; + + for( l = bm.height-1; l > 0; l-- ) { - int l; - for( l = bm.height-1; l > 0; l-- ) - { - rb->memmove( save_buffer+l*COLS, save_buffer+l*bm.width, - sizeof( fb_data )*bm.width ); - } - for( l = 0; l < bm.height; l++ ) - { - rb->memset( save_buffer+l*COLS+bm.width, rp_colors[ bgdrawcolor ], - sizeof( fb_data )*(COLS-bm.width) ); - } - rb->memset( save_buffer+COLS*bm.height, rp_colors[ bgdrawcolor ], - sizeof( fb_data )*COLS*(ROWS-bm.height) ); + rb->memmove( save_buffer+l*COLS, save_buffer+l*bm.width, + sizeof( fb_data )*bm.width ); } + for( l = 0; l < bm.height; l++ ) + { + rb->memset( save_buffer+l*COLS+bm.width, rp_colors[ bgdrawcolor ], + sizeof( fb_data )*(COLS-bm.width) ); + } + rb->memset( save_buffer+COLS*bm.height, rp_colors[ bgdrawcolor ], + sizeof( fb_data )*COLS*(ROWS-bm.height) ); + return ret; } @@ -2953,7 +2956,7 @@ enum plugin_status plugin_start(struct plugin_api* api, void* parameter) { if( load_bitmap( parameter ) <= 0 ) { - rb->splash( 1*HZ, "Error"); + rb->splash( 1*HZ, "File Open Error"); clear_drawing(); } else -- cgit v1.2.3