From 0d8afad55980eee2f3e634680f93d08c580a5364 Mon Sep 17 00:00:00 2001
From: Colin Snover
Date: Sat, 11 Nov 2017 20:48:04 -0600
Subject: GRAPHICS: Fix buffer overflow in drawBevelSquareAlg

Thanks to garethbp for discovering the issue and providing a fix.

Fixes Trac#6468.
---
 graphics/VectorRendererSpec.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'graphics/VectorRendererSpec.cpp')

diff --git a/graphics/VectorRendererSpec.cpp b/graphics/VectorRendererSpec.cpp
index ef7d672fd0..a37c99c561 100644
--- a/graphics/VectorRendererSpec.cpp
+++ b/graphics/VectorRendererSpec.cpp
@@ -2371,8 +2371,8 @@ drawBevelSquareAlg(int x, int y, int w, int h, int bevel, PixelType top_color, P
 	x = MAX(x - bevel, 0);
 	y = MAX(y - bevel, 0);
 
-	w = MIN(w + (bevel * 2), (int)_activeSurface->w);
-	h = MIN(h + (bevel * 2), (int)_activeSurface->h);
+	w = MIN(x + w + (bevel * 2), (int)_activeSurface->w) - x;
+	h = MIN(y + h + (bevel * 2), (int)_activeSurface->h) - y;
 
 	ptr_left = (PixelType *)_activeSurface->getBasePtr(x, y);
 	i = bevel;
-- 
cgit v1.2.3