Magic-Mirror/radare2
1
0
Fork 0
mirror of https://github.com/radareorg/radare2.git synced 2024-11-23 21:29:49 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Fix buffer overflow in RConsPixel API affecting the braile renderer ##cons

Browse Source
This commit is contained in:
pancake 2021-10-28 17:19:43 +02:00 committed by pancake
parent db31f5539e
commit 9539aa12f4
2 changed files with 26 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
libr/cons/pixel.c
View File

@ -15,6 +15,10 @@ R_API RConsPixel *r_cons_pixel_new(int w, int h) {
p->h = h;
p->buf_size = w * h;
p->buf = calloc (w, h);
if (!p->buf) {
free (p);
return NULL;
}
return p;
}
@ -25,7 +29,21 @@ R_API void r_cons_pixel_free(RConsPixel *p) {
}
}
R_API void r_cons_pixel_set(RConsPixel *p, int x, int y, int v) {
R_API ut8 r_cons_pixel_get(RConsPixel *p, int x, int y) {
r_return_val_if_fail (p, 0);
if (x < 0 || x >= p->w) {
return 0;
}
if (y < 0 || y >= p->h) {
return 0;
}
int pos = x + (y * p->w);
if (pos > 0 && pos < p->buf_size) {
return p->buf[pos];
}
return 0;
}
R_API void r_cons_pixel_set(RConsPixel *p, int x, int y, ut8 v) {
r_return_if_fail (p);
if (x < 0 || x >= p->w) {
return;
@ -94,7 +112,11 @@ R_API char *r_cons_pixel_tostring(RConsPixel *p) {
size_t x, y;
for (y = 0; y < p->h; y += 4) {
for (x = 0; x < p->w; x += 2) {
ut8 *X = p->buf + (x + (y * p->w));
size_t delta = x + ((y + 3) * p->w) + 1;
if (delta >= p->buf_size) {
continue;
}
ut8 *X = p->buf + (x + ((y + 0) * p->w));
int u = 0;
u |= (X[0]?$00:0);
u |= (X[1]?$01:0);

3
libr/include/r_cons.h
View File

@ -983,7 +983,8 @@ R_API RConsPixel *r_cons_pixel_new(int w, int h);
R_API void r_cons_pixel_free(RConsPixel *p);
R_API void r_cons_pixel_flush(RConsPixel *p, int sx, int sy);
R_API char *r_cons_pixel_drain(RConsPixel *p);
R_API void r_cons_pixel_set(RConsPixel *p, int x, int y, int v);
R_API ut8 r_cons_pixel_get(RConsPixel *p, int x, int y);
R_API void r_cons_pixel_set(RConsPixel *p, int x, int y, ut8 v);
R_API void r_cons_pixel_sets(RConsPixel *p, int x, int y, const char *s);
R_API void r_cons_pixel_fill(RConsPixel *p, int _x, int _y, int w, int h, int v);
R_API char *r_cons_pixel_tostring(RConsPixel *p);