From 9ea3cb62c94b2f293cc5dbc95518b8312434e093 Mon Sep 17 00:00:00 2001
From: Simon Howard
Date: Thu, 5 Nov 2009 19:57:55 +0000
Subject: Perform bounds checking on values passed to TXT_UpdateScreenArea() to
 avoid crashes.

Subversion-branch: /trunk/chocolate-doom
Subversion-revision: 1728
---
 textscreen/txt_sdl.c | 31 ++++++++++++++++++++++++++++---
 1 file changed, 28 insertions(+), 3 deletions(-)

(limited to 'textscreen')

diff --git a/textscreen/txt_sdl.c b/textscreen/txt_sdl.c
index 4f8bc2a8..cd7dd77d 100644
--- a/textscreen/txt_sdl.c
+++ b/textscreen/txt_sdl.c
@@ -263,19 +263,44 @@ static inline void UpdateCharacter(int x, int y)
     }
 }
 
+static int LimitToRange(int val, int min, int max)
+{
+    if (val < min)
+    {
+        return min;
+    }
+    else if (val > max)
+    {
+        return max;
+    }
+    else
+    {
+        return val;
+    }
+}
+
 void TXT_UpdateScreenArea(int x, int y, int w, int h)
 {
     int x1, y1;
+    int x_end;
+    int y_end;
+
+    x_end = LimitToRange(x + w, 0, TXT_SCREEN_W - 1);
+    y_end = LimitToRange(y + h, 0, TXT_SCREEN_H - 1);
+    x = LimitToRange(x, 0, TXT_SCREEN_W - 1);
+    y = LimitToRange(y, 0, TXT_SCREEN_H - 1);
 
-    for (y1=y; y1<y+h; ++y1)
+    for (y1=y; y1<y_end; ++y1)
     {
-        for (x1=x; x1<x+w; ++x1)
+        for (x1=x; x1<x_end; ++x1)
         {
             UpdateCharacter(x1, y1);
         }
     }
 
-    SDL_UpdateRect(screen, x * font->w, y * font->h, w * font->w, h * font->h);
+    SDL_UpdateRect(screen,
+                   x * font->w, y * font->h,
+                   (x_end - x) * font->w, (y_end - y) * font->h);
 }
 
 void TXT_UpdateScreen(void)
-- 
cgit v1.2.3