Skip to content

Commit

Permalink
Fix a potential internal stack overflow in Xlib graphics driver.
Browse files Browse the repository at this point in the history
git-svn-id: file:///fltk/svn/fltk/branches/branch-1.4@12752 ea41ed52-d2ee-0310-a9c1-e6b18d33e121
  • Loading branch information
Albrecht Schlosser committed Mar 15, 2018
1 parent 6e4ed88 commit 7d985f8
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 7 deletions.
4 changes: 3 additions & 1 deletion src/drivers/Xlib/Fl_Xlib_Graphics_Driver.H
Expand Up @@ -46,6 +46,7 @@ struct _XRegion {
#include <pango/pango.h>
#endif

#define FL_XLIB_GRAPHICS_TRANSLATION_STACK_SIZE (20)

/**
\brief The Xlib-specific graphics class.
Expand All @@ -56,7 +57,8 @@ class FL_EXPORT Fl_Xlib_Graphics_Driver : public Fl_Scalable_Graphics_Driver {
private:
int offset_x_, offset_y_; // translation between user and graphical coordinates: graphical = user + offset
unsigned depth_; // depth of translation stack
int stack_x_[20], stack_y_[20]; // translation stack allowing cumulative translations
int stack_x_[FL_XLIB_GRAPHICS_TRANSLATION_STACK_SIZE]; // translation stack allowing cumulative translations
int stack_y_[FL_XLIB_GRAPHICS_TRANSLATION_STACK_SIZE];
int line_delta_;
virtual void set_current_();
int clip_max_; // +/- x/y coordinate limit (16-bit coordinate space)
Expand Down
15 changes: 9 additions & 6 deletions src/drivers/Xlib/Fl_Xlib_Graphics_Driver.cxx
Expand Up @@ -263,14 +263,17 @@ Region Fl_Xlib_Graphics_Driver::scale_clip(float f) {


void Fl_Xlib_Graphics_Driver::translate_all(int dx, int dy) { // reversibly adds dx,dy to the offset between user and graphical coordinates
stack_x_[depth_] = offset_x_;
stack_y_[depth_] = offset_y_;
offset_x_ = stack_x_[depth_] + dx;
offset_y_ = stack_y_[depth_] + dy;
if (depth_ < FL_XLIB_GRAPHICS_TRANSLATION_STACK_SIZE) {
stack_x_[depth_] = offset_x_;
stack_y_[depth_] = offset_y_;
depth_++;
} else {
Fl::warning("%s: translate stack overflow!", "Fl_Xlib_Graphics_Driver");
}
offset_x_ += dx;
offset_y_ += dy;
push_matrix();
translate(dx, dy);
if (depth_ < sizeof(stack_x_)/sizeof(int)) depth_++;
else Fl::warning("%s: translate stack overflow!", "Fl_Xlib_Graphics_Driver");
}

void Fl_Xlib_Graphics_Driver::untranslate_all() { // undoes previous translate_all()
Expand Down

0 comments on commit 7d985f8

Please sign in to comment.