shithub: rgbds

Info  •  Files  •  Log  •  Branches

Fix a potential out-of-bounds array access in RGBGFX

This was caught by ASAN for pokered's gfx/battle/minimize.png.

--- a/src/gfx/gb.c

+++ b/src/gfx/gb.c

@@ -224,7 +224,11 @@

 		if (!tile)

 			err(1, "%s: Failed to allocate memory for tile",

 			    __func__);

-		for (i = 0; i < tile_size; i++) {

+		/*

+		 * If the input image doesn't fill the last tile,

+		 * `gb_i` will reach `gb_size`.

+		 */

+		for (i = 0; i < tile_size && gb_i < gb_size; i++) {

 			tile[i] = gb->data[gb_i];

 			gb_i++;

 		}