djsundog/circuitpython
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Always check TileGrid's x, y

Browse Source 
When using an int index you could end up writing past the end of
TileGrid's memory.

Fixes #1747
This commit is contained in:
Scott Shawcroft 2019-04-05 13:10:47 -07:00
parent df058c971f
commit 04a4e8a38d
No known key found for this signature in database
GPG Key ID: FD0EDC4B6C53CA59
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
shared-bindings/displayio/TileGrid.c
View File

@ -259,9 +259,10 @@ STATIC mp_obj_t tilegrid_subscr(mp_obj_t self_in, mp_obj_t index_obj, mp_obj_t v
mp_obj_get_array_fixed_n(index_obj, 2, &items);
x = mp_obj_get_int(items[0]);
y = mp_obj_get_int(items[1]);
if (x >= common_hal_displayio_tilegrid_get_width(self) || y >= common_hal_displayio_tilegrid_get_height(self)) {
mp_raise_IndexError(translate("tile index out of bounds"));
}
}
if (x >= common_hal_displayio_tilegrid_get_width(self) ||
y >= common_hal_displayio_tilegrid_get_height(self)) {
mp_raise_IndexError(translate("tile index out of bounds"));
}
if (value_obj == MP_OBJ_SENTINEL) {