202be57bb9
not checking the rectangle dimensions causes integer overflows and memory corruption. adding a new badrect() function that checks for these cases.
26 lines
449 B
C
26 lines
449 B
C
#include <u.h>
|
|
#include <libc.h>
|
|
#include <draw.h>
|
|
#include <memdraw.h>
|
|
|
|
int
|
|
unloadmemimage(Memimage *i, Rectangle r, uchar *data, int ndata)
|
|
{
|
|
int y, l;
|
|
uchar *q;
|
|
|
|
if(badrect(r) || !rectinrect(r, i->r))
|
|
return -1;
|
|
l = bytesperline(r, i->depth);
|
|
if(ndata < l*Dy(r))
|
|
return -1;
|
|
ndata = l*Dy(r);
|
|
q = byteaddr(i, r.min);
|
|
for(y=r.min.y; y<r.max.y; y++){
|
|
memmove(data, q, l);
|
|
q += i->width*sizeof(ulong);
|
|
data += l;
|
|
}
|
|
return ndata;
|
|
}
|