Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Enrico Weigelt, metux IT consult 6a97f6d38e render: filter: fix integer-overflow bypass of convolution size check ... convolutionFilterValidateParams() derives w/h from client-supplied xFixed values via the sign-extending xFixedToInt(), then checked 'w * h > nparams' as a plain (signed) int product. A client can choose negative w/h so the mathematical product is huge but the signed int product wraps to a small or negative value, defeating the bounds check that is supposed to reject a convolution kernel larger than the actual parameter list. Reject negative w/h outright and compare the product as int64_t so it cannot wrap before the comparison. Signed-off-by: Enrico Weigelt, metux IT consult <enrico.weigelt@vnc.biz>		2026-07-03 19:59:53 +02:00
..
animcur.c	render: parentheses around macro argument symbols	2026-06-25 06:53:30 +02:00
filter.c	render: filter: fix integer-overflow bypass of convolution size check	2026-07-03 19:59:53 +02:00
glyph.c	render: parentheses around macro argument symbols	2026-06-25 06:53:30 +02:00
glyphstr_priv.h	render: parentheses around macro argument symbols	2026-06-25 06:53:30 +02:00
matrix.c	treewide: clean up includes of misc.h	2026-06-19 19:24:57 +02:00
meson.build
miindex.c
mipict.c
mirect.c
mitrap.c	treewide: replace min/max macros by non-exported MIN/MAX and deprecate them	2026-06-25 14:06:17 +02:00
mitri.c
picture.c	treewide: clean up includes of misc.h	2026-06-19 19:24:57 +02:00
picturestr_priv.h	render: parentheses around macro argument symbols	2026-06-25 06:53:30 +02:00
render.c	treewide: fix result type of BitmapBytePad() to size_t	2026-06-29 15:44:48 +02:00