From 3d0daaa3ad848b16c48ccdeda739b6b52689768f Mon Sep 17 00:00:00 2001 From: Jacek Jendrzej Date: Mon, 22 Jun 2015 19:24:53 +0200 Subject: [PATCH] tuxtxt.cpp: fixheap buffer overflow Origin commit data ------------------ Commit: https://github.com/neutrino-images/ni-neutrino/commit/160dda776cdcdaeece911ed0bb09eede141e0fb5 Author: Jacek Jendrzej Date: 2015-06-22 (Mon, 22 Jun 2015) --- lib/libtuxtxt/tuxtxt.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/libtuxtxt/tuxtxt.cpp b/lib/libtuxtxt/tuxtxt.cpp index 37f738708..91722ee88 100644 --- a/lib/libtuxtxt/tuxtxt.cpp +++ b/lib/libtuxtxt/tuxtxt.cpp @@ -4765,7 +4765,8 @@ void RenderChar(int Char, tstPageAttr *Attribute, int zoom, int yoffset) for (Pitch = 0; Pitch < sbit->pitch; Pitch++) { if (sbit_diacrit->pitch > Pitch && sbit_diacrit->height > Row) - sbitbuffer[Row*sbit->pitch+Pitch] |= sbit_diacrit->buffer[Row*sbit->pitch+Pitch]; + if((sbit_diacrit->pitch*sbit_diacrit->height) > (Row*sbit->pitch+Pitch)) + sbitbuffer[Row*sbit->pitch+Pitch] |= sbit_diacrit->buffer[Row*sbit->pitch+Pitch]; } } }