1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
From: Ben Harris <bjh21@bjh21.me.uk>
Date: Tue, 10 Jan 2023 11:07:14 +0000
Subject: [PATCH 315/389] Last-ditch maximum size limit for Flip
Origin: https://git.tartarus.org/?p=simon/puzzles.git;a=commitdiff;h=26d0633f87ccdbaf7035e2e14d9dfbfd7f379527
Bug-Debian: https://bugs.debian.org/1028986
This makes sure that width * height <= INT_MAX, which it rather needs
to be. Also in Flip's case that the square of the area still fits in
an int.
flip.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
@@ -8,6 +8,7 @@
#include <string.h>
#include <assert.h>
#include <ctype.h>
+#include <limits.h>
#include <math.h>
#include "puzzles.h"
@@ -181,9 +182,16 @@ static game_params *custom_params(const
static const char *validate_params(const game_params *params, bool full)
{
+ int wh;
+
if (params->w <= 0 || params->h <= 0)
return "Width and height must both be greater than zero";
- return NULL;
+ if (params->w > (INT_MAX - 3) / params->h)
+ return "Width times height must not be unreasonably large";
+ wh = params->w * params->h;
+ if (wh > (INT_MAX - 3) / wh)
+ return "Width times height is too large";
+ return NULL;
}
static char *encode_bitmap(unsigned char *bmp, int len)
|
