From d3b27f09af58c0d870c824bf262744d6aed2eb76 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stephan=20A=C3=9Fmus?= Date: Fri, 11 Nov 2005 00:12:32 +0000 Subject: [PATCH] check if the bitmap size can even be expressed in an int32, set init status to B_BAD_VALUE if not. This works arround a bug in WonderBrush... :-) git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@14845 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- src/kits/interface/Bitmap.cpp | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/src/kits/interface/Bitmap.cpp b/src/kits/interface/Bitmap.cpp index 9b28e1657c..0d73ad729b 100644 --- a/src/kits/interface/Bitmap.cpp +++ b/src/kits/interface/Bitmap.cpp @@ -15,6 +15,7 @@ #include #include #include +#include #include #include @@ -2177,8 +2178,6 @@ BBitmap::InitObject(BRect bounds, color_space colorSpace, uint32 flags, //printf("BBitmap::InitObject(bounds: BRect(%.1f, %.1f, %.1f, %.1f), format: %ld, flags: %ld, bpr: %ld\n", // bounds.left, bounds.top, bounds.right, bounds.bottom, colorSpace, flags, bytesPerRow); - // TODO: Hanlde setting up the offscreen window if we're such a bitmap! - // TODO: Should we handle rounding of the "bounds" here? How does R5 behave? status_t error = B_OK; @@ -2190,8 +2189,18 @@ BBitmap::InitObject(BRect bounds, color_space colorSpace, uint32 flags, CleanUp(); // check params - if (!bounds.IsValid() || !bitmaps_support_space(colorSpace, NULL)) + if (!bounds.IsValid() || !bitmaps_support_space(colorSpace, NULL)) { error = B_BAD_VALUE; + } else { + // bounds is in floats and might be valid but much larger than what we can handle + // the size could not be expressed in int32 + double realSize = bounds.Width() * bounds.Height(); + if (realSize > (double)(INT32_MAX / 4)) { + fprintf(stderr, "bitmap bounds is much too large: BRect(%.1f, %.1f, %.1f, %.1f)\n", + bounds.left, bounds.top, bounds.right, bounds.bottom); + error = B_BAD_VALUE; + } + } if (error == B_OK) { int32 bpr = get_bytes_per_row(colorSpace, bounds.IntegerWidth() + 1); if (bytesPerRow < 0)