diff options
| author | Dave Chapman <dave@dchapman.com> | 2008-03-24 00:03:05 +0000 |
|---|---|---|
| committer | Dave Chapman <dave@dchapman.com> | 2008-03-24 00:03:05 +0000 |
| commit | 99c0978faa94b0e2fabe5d06000a10c8d48e7a0c (patch) | |
| tree | c86317bb69ca9baea5a67a6f2b30e94eaea831a1 /apps/gui/wps_parser.c | |
| parent | 1644404fdd99ece8b89fd7cc76e7d4c271d18e0b (diff) | |
Add a sanity-check to ensure only in-range subimages are referenced in %xd tags. Plus some tab policing.
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@16774 a1c6a512-1295-4272-9138-f99709370657
Diffstat (limited to 'apps/gui/wps_parser.c')
| -rw-r--r-- | apps/gui/wps_parser.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/apps/gui/wps_parser.c b/apps/gui/wps_parser.c index d5e29f3a4f..9327e89859 100644 --- a/apps/gui/wps_parser.c +++ b/apps/gui/wps_parser.c @@ -443,6 +443,10 @@ static int parse_image_display(const char *wps_bufptr, if ((subimage = get_image_id(wps_bufptr[1])) != -1) { + /* Sanity check */ + if (subimage >= wps_data->img[n].num_subimages) + return WPS_ERROR_INVALID_PARAM; + /* Store sub-image number to display in high bits */ token->value.i = n | (subimage << 8); return 2; /* We have consumed 2 bytes */ @@ -1382,7 +1386,7 @@ static void load_wps_bitmaps(struct wps_data *wps_data, char *bmpdir) *loaded = true; /* Calculate and store height if this image has sub-images */ - if (n < MAX_IMAGES) + if (n < MAX_IMAGES) wps_data->img[n].subimage_height = wps_data->img[n].bm.height / wps_data->img[n].num_subimages; } |