mirrors/mkxp-z
1
0
Fork 0
mirror of https://github.com/mkxp-z/mkxp-z.git synced 2025-09-10 12:02:53 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Guard against writing to out-of-bounds memory in Bitmap::drawTextInner()

Browse source
This commit is contained in:
刘皓 2025-08-08 11:05:26 -04:00
parent d575c92b2e
commit a872183542
No known key found for this signature in database
GPG key ID: 7901753DB465B711
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/display/bitmap.cpp
View file

@ -2898,11 +2898,11 @@ SDL_Surface *Bitmap::drawTextInner(Exception &exception, FT_Face font, const cha
continue;
}
int glyph_left = glyph_x + (needs_transform ? ((FT_BitmapGlyph)glyph)->left : font->glyph->bitmap_left);
int glyph_top = glyph_y - (needs_transform ? ((FT_BitmapGlyph)glyph)->top : font->glyph->bitmap_top);
int glyph_left = std::max(0, glyph_x + (needs_transform ? ((FT_BitmapGlyph)glyph)->left : font->glyph->bitmap_left));
int glyph_top = std::max(0, glyph_y - (needs_transform ? ((FT_BitmapGlyph)glyph)->top : font->glyph->bitmap_top));
FT_Bitmap *bitmap = needs_transform ? &((FT_BitmapGlyph)glyph)->bitmap : &font->glyph->bitmap;
unsigned int glyph_width = bitmap->width;
unsigned int glyph_height = bitmap->rows;
unsigned int glyph_width = std::min((unsigned int)(bitmapRect.w - glyph_left), bitmap->width);
unsigned int glyph_height = std::min((unsigned int)(bitmapRect.h - glyph_top), bitmap->rows);
if (solid)
for (unsigned int y = 0; y < glyph_height; ++y)