ctdo
/
crashtest-r0ket
16
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fix buffer overflow in font handler

This commit is contained in:
Hagen Fritsch 2011-08-11 11:53:07 +02:00 committed by Stefan `Sec` Zehl
parent b605025acf
commit 77fb7a388a
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
firmware/lcd/render.c
View File

@ -223,7 +223,9 @@ int DoChar(int sx, int sy, int c){
_getFontData(SEEK_DATA,toff); _getFontData(SEEK_DATA,toff);
UINT res; UINT res;
UINT readbytes; UINT readbytes;
res = f_read(&file, charBuf, width*height, &readbytes); UINT size = width * height;
if(size > MAXCHR) size = MAXCHR;
res = f_read(&file, charBuf, size, &readbytes);
if(res != FR_OK || readbytes<width*height) if(res != FR_OK || readbytes<width*height)
return sx; return sx;
data=charBuf; data=charBuf;
@ -252,7 +254,9 @@ int DoChar(int sx, int sy, int c){
postblank = read_byte (); postblank = read_byte ();
width-=3; width-=3;
width/=height; width/=height;
res = f_read(&file, charBuf, width*height, &readbytes); UINT size = width * height;
if(size > MAXCHR) size = MAXCHR;
res = f_read(&file, charBuf, size, &readbytes);
if(res != FR_OK || readbytes<width*height) if(res != FR_OK || readbytes<width*height)
return sx; return sx;
data=charBuf; data=charBuf;