devs/foxbox
1
0
Fork 0
forked from len0rd/rockbox
Code Pull requests Activity

Rockpaint plugin: protect against loading bitmaps that are too big. Fixes FS #7040

Browse source 
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@13204 a1c6a512-1295-4272-9138-f99709370657
This commit is contained in:
Peter D'Hoye 2007-04-18 21:13:08 +00:00
parent b44b660ac4
commit 0b11d983e7
1 changed files with 19 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

35
apps/plugins/rockpaint.c
View file

@ -2903,25 +2903,28 @@ static int load_bitmap( char *file )
{
struct bitmap bm;
bool ret;
int l;
bm.data = (char*)save_buffer;
ret = rb->read_bmp_file( file, &bm, ROWS*COLS*sizeof( fb_data ),
FORMAT_NATIVE );
if( bm.width < COLS )
FORMAT_NATIVE );
if((bm.width > COLS ) || ( bm.height > ROWS ))
return -1;
for( l = bm.height-1; l > 0; l-- )
{
int l;
for( l = bm.height-1; l > 0; l-- )
{
rb->memmove( save_buffer+l*COLS, save_buffer+l*bm.width,
sizeof( fb_data )*bm.width );
}
for( l = 0; l < bm.height; l++ )
{
rb->memset( save_buffer+l*COLS+bm.width, rp_colors[ bgdrawcolor ],
sizeof( fb_data )*(COLS-bm.width) );
}
rb->memset( save_buffer+COLS*bm.height, rp_colors[ bgdrawcolor ],
sizeof( fb_data )*COLS*(ROWS-bm.height) );
rb->memmove( save_buffer+l*COLS, save_buffer+l*bm.width,
sizeof( fb_data )*bm.width );
}
for( l = 0; l < bm.height; l++ )
{
rb->memset( save_buffer+l*COLS+bm.width, rp_colors[ bgdrawcolor ],
sizeof( fb_data )*(COLS-bm.width) );
}
rb->memset( save_buffer+COLS*bm.height, rp_colors[ bgdrawcolor ],
sizeof( fb_data )*COLS*(ROWS-bm.height) );
return ret;
}
@ -2953,7 +2956,7 @@ enum plugin_status plugin_start(struct plugin_api* api, void* parameter)
{
if( load_bitmap( parameter ) <= 0 )
{
rb->splash( 1*HZ, "Error");
rb->splash( 1*HZ, "File Open Error");
clear_drawing();
}
else