mirrors/foot
1
0
Fork 0
mirror of https://codeberg.org/dnkl/foot.git synced 2026-06-13 14:33:17 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

sixel: fix NULL deref when using a shared palette and gamma-correct blending

Browse source 
This fixes a copy-paste error where we read/modified/wrote the
private-palette instead of the shared palette.

Since the private palette is NULL in this case, that meant a crash.

Closes #2370
This commit is contained in:
Daniel Eklöf 2026-06-12 18:09:02 +02:00
parent c9c448e611
commit 75e201608b
No known key found for this signature in database
GPG key ID: 5BBD4992C116573F
2 changed files with 7 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
CHANGELOG.md
View file

@ -100,12 +100,15 @@
across the starting column.
* Passing a very large value as CHT/CBT argument hangs the terminal
([#2360][2360]).
* Sixel: crash when using a shared palette and gamma-correct blending
has been enabled, or foot is using 10-bit surface ([#2370][2370]).
[2353]: https://codeberg.org/dnkl/foot/issues/2353
[2352]: https://codeberg.org/dnkl/foot/issues/2352
[2327]: https://codeberg.org/dnkl/foot/issues/2327
[2379]: https://codeberg.org/dnkl/foot/issues/2379
[2360]: https://codeberg.org/dnkl/foot/issues/2360
[2370]: https://codeberg.org/dnkl/foot/issues/2370
### Security

8
sixel.c
View file

@ -169,10 +169,10 @@ sixel_init(struct terminal *term, int p1, int p2, int p3)
if (term->sixel.linear_blending || term->sixel.use_10bit) {
for (size_t i = 0; i < active_palette_entries; i++) {
uint8_t r = (term->sixel.private_palette[i] >> 16) & 0xff;
uint8_t g = (term->sixel.private_palette[i] >> 8) & 0xff;
uint8_t b = (term->sixel.private_palette[i] >> 0) & 0xff;
term->sixel.private_palette[i] = color_decode_srgb(term, r, g, b);
uint8_t r = (term->sixel.shared_palette[i] >> 16) & 0xff;
uint8_t g = (term->sixel.shared_palette[i] >> 8) & 0xff;
uint8_t b = (term->sixel.shared_palette[i] >> 0) & 0xff;
term->sixel.shared_palette[i] = color_decode_srgb(term, r, g, b);
}
}
} else {