From: simon <simon@cda61777-01e9-0310-a592-d414129be87e>
Date: Wed, 4 Aug 2004 16:27:28 +0000 (+0000)
Subject: Explicit bounds checking on the bmp[] array.
X-Git-Url: https://git.distorted.org.uk/~mdw/sgt/halibut/commitdiff_plain/5333269ab7c2102da566e61bc827c7d4c31ee40c

Explicit bounds checking on the bmp[] array.


git-svn-id: svn://svn.tartarus.org/sgt/halibut@4400 cda61777-01e9-0310-a592-d414129be87e
---

diff --git a/bk_paper.c b/bk_paper.c
index a8479c7..eb3caf0 100644
--- a/bk_paper.c
+++ b/bk_paper.c
@@ -1318,7 +1318,9 @@ static int string_width(font_data *font, wchar_t const *string, int *errs)
     for (; *string; string++) {
 	int index;
 
-	index = font->bmp[(unsigned short)*string];
+	index = (*string < 0 || *string > 0xFFFF ? 0xFFFF :
+		 font->bmp[*string]);
+
 	if (index == 0xFFFF) {
 	    if (errs)
 		*errs = 1;
@@ -1766,7 +1768,8 @@ static int render_string(page_data *page, font_data *font, int fontsize,
     textpos = textwid = 0;
 
     while (*str) {
-	glyph = font->bmp[*str];
+	glyph = (*str < 0 || *str > 0xFFFF ? 0xFFFF :
+		 font->bmp[*str]);
 
 	if (glyph == 0xFFFF) {
 	    str++;