shithub: orca

Info  •  Files  •  Log  •  Branches

plan9: bound checks for fieldset and selmove

--- a/plan9.c

+++ b/plan9.c

@@ -302,7 +302,7 @@

 	int y;

 	if (insert) {

-		for (y = cury; y < cury+selh; y++)

+		for (y = cury; y < cury+selh && y < field.height; y++)

 			memset(&field.buffer[curx + field.width*y], key, selw);

 	} else {

 		if (curx < field.width-1)

@@ -316,6 +316,9 @@

 {

 	int i;

+	if (curx+x < 0 || cury+y < 0)

+		return;

+

 	field_resize_raw(&copyfield, selh, selw);

 	gbuffer_copy_subrect(

 		field.buffer,

@@ -326,8 +329,8 @@

 		selh, selw

 	);

-	for (i = cury; i < cury+selh; i++)

-		memset(&field.buffer[curx + field.width*i], '.', selw);

+	for (i = cury; i < cury+selh && i < field.height; i++)

+		memset(&field.buffer[curx + field.width*i], '.', MIN(selw, field.width-curx));

 	gbuffer_copy_subrect(

 		copyfield.buffer,