Skip to content
Snippets Groups Projects
Commit 33458100 authored by Deucе's avatar Deucе :ok_hand_tone4:
Browse files

"Range check" RIP ICN width/height to untaint them.

This is purely to shut up Coverity since there's no way the value
could be outside the range.
parent 22536190
Branches
Tags
No related merge requests found
......@@ -13844,12 +13844,20 @@ do_rip_command(int level, int sublevel, int cmd, const char *rawargs)
break;
}
pix->width = tmp + 1;
if (pix->width < 1)
pix->width = 1;
if (pix->width > 65536)
pix->width = 65536;
if (fread(&tmp, sizeof(tmp), 1, icn) != 1) {
free(pix);
fclose(icn);
break;
}
pix->height = tmp + 1;
if (pix->height < 1)
pix->height = 1;
if (pix->height > 65536)
pix->height = 65536;
if ((x1 + rip.viewport.sx + pix->width - 1
> rip.viewport.ex)
|| (y1 + rip.viewport.sy + pix->height - 1
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment