shithub: puzzles

Info  •  Files  •  Log  •  Branches

Integer overflow in game_size(). Oops.

[originally from svn r5921]

--- a/rect.c

+++ b/rect.c

@@ -2307,9 +2307,12 @@

      * Each window dimension equals the tile size times 1.5 more

      * than the grid dimension (the border is 3/4 the width of the

      * tiles).

+     * 

+     * We must cast to unsigned before multiplying by two, because

+     * *x might be INT_MAX.

      */

-    tsx = 2 * *x / (2 * params->w + 3);

-    tsy = 2 * *y / (2 * params->h + 3);

+    tsx = 2 * (unsigned)*x / (2 * params->w + 3);

+    tsy = 2 * (unsigned)*y / (2 * params->h + 3);

     ts = min(tsx, tsy);

     if (expand)

         ds->tilesize = ts;