From 6ea6e0de706d98147c5382d6e2fb01751d327581 Mon Sep 17 00:00:00 2001 From: Tomi Valkeinen Date: Tue, 9 Jan 2018 12:50:29 +0200 Subject: add safeguards to draw_*_pixel() to prevent memory corruption Signed-off-by: Tomi Valkeinen --- kms++util/src/drawing.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kms++util/src/drawing.cpp b/kms++util/src/drawing.cpp index a187dc0..4e5c6c1 100644 --- a/kms++util/src/drawing.cpp +++ b/kms++util/src/drawing.cpp @@ -8,6 +8,9 @@ namespace kms { void draw_rgb_pixel(IFramebuffer& buf, unsigned x, unsigned y, RGB color) { + if (x >= buf.width() || y >= buf.height()) + throw runtime_error("attempt to draw outside the buffer"); + switch (buf.format()) { case PixelFormat::XRGB8888: case PixelFormat::ARGB8888: @@ -58,6 +61,9 @@ void draw_rgb_pixel(IFramebuffer& buf, unsigned x, unsigned y, RGB color) void draw_yuv422_macropixel(IFramebuffer& buf, unsigned x, unsigned y, YUV yuv1, YUV yuv2) { + if ((x + 1) >= buf.width() || y >= buf.height()) + throw runtime_error("attempt to draw outside the buffer"); + ASSERT((x & 1) == 0); uint8_t *p = (uint8_t*)(buf.map(0) + buf.stride(0) * y + x * 2); @@ -104,6 +110,9 @@ void draw_yuv422_macropixel(IFramebuffer& buf, unsigned x, unsigned y, YUV yuv1, void draw_yuv420_macropixel(IFramebuffer& buf, unsigned x, unsigned y, YUV yuv1, YUV yuv2, YUV yuv3, YUV yuv4) { + if ((x + 1) >= buf.width() || (y + 1) >= buf.height()) + throw runtime_error("attempt to draw outside the buffer"); + ASSERT((x & 1) == 0); ASSERT((y & 1) == 0); -- cgit v1.2.3-54-g00ecf