mirrors/recycled-ni-neutrino
1
0
Fork 0
mirror of https://github.com/tuxbox-fork-migrations/recycled-ni-neutrino.git synced 2025-08-30 17:01:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

src/driver/framebuffer.cpp: fix-up reading raw icons. If read failed or it read an corrupted header it could

Browse Source 
lead to bad allocations. Prevent that.


Origin commit data
------------------
Branch: ni/coolstream
Commit: e9f049c677
Author: [CST] Bas <bas@coolstreamtech.com>
Date: 2015-02-17 (Tue, 17 Feb 2015)

Origin message was:
------------------
src/driver/framebuffer.cpp: fix-up reading raw icons. If read failed or it read an corrupted header it could
              lead to bad allocations. Prevent that.


------------------
This commit was generated by Migit
This commit is contained in:
[CST] Bas
2015-02-17 19:41:24 +08:00
committed by [CST] Focus
parent def0da17c6
commit c16dc96284
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/driver/framebuffer.cpp
View File

@@ -1099,10 +1099,25 @@ bool CFrameBuffer::paintIcon(const std::string & filename, const int x, const in
//printf("paintIcon: error while loading icon: %s\n", newname.c_str()); //printf("paintIcon: error while loading icon: %s\n", newname.c_str());
return false; return false;
} }
read(lfd, &header, sizeof(struct rawHeader));
ssize_t s = read(lfd, &header, sizeof(struct rawHeader));
if (s < 0) {
perror("read");
return false;
}
if (s < (ssize_t) sizeof(rawHeader)){
printf("paintIcon: error while loading icon: %s, header too small\n", newname.c_str());
return false;
}
tmpIcon.width = width = (header.width_hi << 8) | header.width_lo; tmpIcon.width = width = (header.width_hi << 8) | header.width_lo;
tmpIcon.height = height = (header.height_hi << 8) | header.height_lo; tmpIcon.height = height = (header.height_hi << 8) | header.height_lo;
if (!width || !height) {
printf("paintIcon: error while loading icon: %s, wrong dimensions (%dHx%dW)\n", newname.c_str(), height, width);
return false;
}
int dsize = width*height*sizeof(fb_pixel_t); int dsize = width*height*sizeof(fb_pixel_t);