diff options
| author | Sadrul Habib Chowdhury <sadrul@users.sourceforge.net> | 2010-03-03 11:18:55 -0500 |
|---|---|---|
| committer | Sadrul Habib Chowdhury <sadrul@users.sourceforge.net> | 2010-03-03 11:18:55 -0500 |
| commit | da8e87d6505fb33ed131144a33af88c6d0dc96fd (patch) | |
| tree | 2ff18481123c272c71e53dd502b48acbefdb3b74 | |
| parent | 48624f98db28bd8c117cf1aebfc2cd326f6243bc (diff) | |
| download | screen-da8e87d6505fb33ed131144a33af88c6d0dc96fd.tar.gz | |
Sanity check line numbers for non-negative value.
It looks like 'ys' can be negative at times, which results in invalid
memory reads, and possibly writes. Valgrind log from Friedrich Delgado
Friedrichs in savannah bug #29050.
| -rw-r--r-- | src/layer.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/layer.c b/src/layer.c index 88d7360..9c1fe34 100644 --- a/src/layer.c +++ b/src/layer.c @@ -1285,6 +1285,8 @@ int ys, ye; { if (!layer->l_pause.d) return; + if (ys < 0) + ys = 0; if (ye >= layer->l_height) ye = layer->l_height - 1; if (xe >= layer->l_width) |