Skip to content

Commit 6367d2f

Browse files
committed
Prevent integer overflow reported in #118, thanks to @SuhwanSong
1 parent 33f00d5 commit 6367d2f

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

src/fromsixel.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -369,26 +369,26 @@ image_buffer_resize(
369369
if (width > image->width) { /* if width is extended */
370370
for (n = 0; n < min_height; ++n) {
371371
/* copy from source image */
372-
memcpy(alt_buffer + width * n,
373-
image->data + image->width * n,
372+
memcpy(alt_buffer + (size_t)width * n,
373+
image->data + (size_t)image->width * n,
374374
(size_t)image->width);
375375
/* fill extended area with background color */
376-
memset(alt_buffer + width * n + image->width,
376+
memset(alt_buffer + (size_t)width * n + image->width,
377377
bgindex,
378378
(size_t)(width - image->width));
379379
}
380380
} else {
381381
for (n = 0; n < min_height; ++n) {
382382
/* copy from source image */
383-
memcpy(alt_buffer + width * n,
384-
image->data + image->width * n,
383+
memcpy(alt_buffer + (size_t)width * n,
384+
image->data + (size_t)image->width * n,
385385
(size_t)width);
386386
}
387387
}
388388

389389
if (height > image->height) { /* if height is extended */
390390
/* fill extended area with background color */
391-
memset(alt_buffer + width * image->height,
391+
memset(alt_buffer + (size_t)width * image->height,
392392
bgindex,
393393
(size_t)(width * (height - image->height)));
394394
}
@@ -472,7 +472,7 @@ sixel_decode_raw_impl(
472472
int sx;
473473
int sy;
474474
int c;
475-
int pos;
475+
size_t pos;
476476
unsigned char *p0 = p;
477477

478478
while (p < p0 + len) {
@@ -674,7 +674,7 @@ sixel_decode_raw_impl(
674674
if (context->repeat_count <= 1) {
675675
for (i = 0; i < 6; i++) {
676676
if ((bits & sixel_vertical_mask) != 0) {
677-
pos = image->width * (context->pos_y + i) + context->pos_x;
677+
pos = (size_t)image->width * (context->pos_y + i) + context->pos_x;
678678
image->data[pos] = context->color_index;
679679
if (context->max_x < context->pos_x) {
680680
context->max_x = context->pos_x;

0 commit comments

Comments
 (0)