Menu

#203 fixed-size arrays of size PL_MAXPOLY cause out-of-bound and posible crashes

open
nobody
None
1
2022-06-03
2022-06-03
giloo
No

xscl and yscl , used by difilt(), are of size PL_MAXPOLY whereas their contents can be of any size, (see line 534 of plcore) causing invalid memory access and code corruption.
This is most visible when drawing a filled area of a shape of size > PL_MAXPOLY on the postscript driver, that triggers difilt() due to its (IMHO too complicated) coordinate conversions.

Discussion


Log in to post a comment.

Want the latest updates on software, tech news, and AI?
Get latest updates about software, tech news, and AI from SourceForge directly in your inbox once a month.