mirrors/neutrino
1
0
Fork 0
mirror of https://github.com/tuxbox-neutrino/neutrino.git synced 2025-09-03 19:01:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

src/driver/framebuffer.cpp: fix-up reading raw icons. If read failed or it read an corrupted header it could

Browse Source 
lead to bad allocations. Prevent that.
This commit is contained in:
[CST] Bas
2015-02-17 19:41:24 +08:00
committed by [CST] Focus
parent f4f6110947
commit e9f049c677
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/driver/framebuffer.cpp
View File

@@ -1099,10 +1099,25 @@ bool CFrameBuffer::paintIcon(const std::string & filename, const int x, const in
//printf("paintIcon: error while loading icon: %s\n", newname.c_str());
return false;
}
read(lfd, &header, sizeof(struct rawHeader));
ssize_t s = read(lfd, &header, sizeof(struct rawHeader));
if (s < 0) {
perror("read");
return false;
}
if (s < (ssize_t) sizeof(rawHeader)){
printf("paintIcon: error while loading icon: %s, header too small\n", newname.c_str());
return false;
}
tmpIcon.width = width = (header.width_hi << 8) | header.width_lo;
tmpIcon.height = height = (header.height_hi << 8) | header.height_lo;
if (!width || !height) {
printf("paintIcon: error while loading icon: %s, wrong dimensions (%dHx%dW)\n", newname.c_str(), height, width);
return false;
}
int dsize = width*height*sizeof(fb_pixel_t);