From fda6e9c2c9178be79d05509e0f7772ba742d8467 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Ekl=C3=B6f?= Date: Thu, 23 Jul 2020 18:13:54 +0200 Subject: [PATCH] sixel: overwrite: use target sixel's height, not cell height When copying the image data for the left and right parts of the splitted images, use the sixel's height, not the cell height. This fixes a crash when the sixel didn't cover the entire cell height. --- CHANGELOG.md | 4 ++++ sixel.c | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 286b7836..9ee46a87 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,6 +20,10 @@ ### Deprecated ### Removed ### Fixed + +* Crash when overwriting a sixel and the row being overwritten did not + cover an entire cell. + ### Security diff --git a/sixel.c b/sixel.c index 7dab1fcc..d45bc916 100644 --- a/sixel.c +++ b/sixel.c @@ -272,7 +272,7 @@ sixel_overwrite(struct terminal *term, struct sixel *six, (six->pos.row + rel_above) & (term->grid->num_rows - 1)}, }; imgs[2].data = malloc(imgs[2].width * imgs[2].height * sizeof(uint32_t)); - for (size_t i = 0; i < term->cell_height; i++) + for (size_t i = 0; i < imgs[2].height; i++) memcpy( &((uint32_t *)imgs[2].data)[i * imgs[2].width], &((const uint32_t *)six->data)[(rel_above * term->cell_height + i) * six->width], @@ -290,7 +290,7 @@ sixel_overwrite(struct terminal *term, struct sixel *six, (six->pos.row + rel_above) & (term->grid->num_rows - 1)}, }; imgs[3].data = malloc(imgs[3].width * imgs[3].height * sizeof(uint32_t)); - for (size_t i = 0; i < term->cell_height; i++) + for (size_t i = 0; i < imgs[3].height; i++) memcpy( &((uint32_t *)imgs[3].data)[i * imgs[3].width], &((const uint32_t *)six->data)[(rel_above * term->cell_height + i) * six->width + rel_right * term->cell_width],