summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--apps/gui/wps_parser.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/apps/gui/wps_parser.c b/apps/gui/wps_parser.c
index d5e29f3a4f..9327e89859 100644
--- a/apps/gui/wps_parser.c
+++ b/apps/gui/wps_parser.c
@@ -443,6 +443,10 @@ static int parse_image_display(const char *wps_bufptr,
if ((subimage = get_image_id(wps_bufptr[1])) != -1)
{
+ /* Sanity check */
+ if (subimage >= wps_data->img[n].num_subimages)
+ return WPS_ERROR_INVALID_PARAM;
+
/* Store sub-image number to display in high bits */
token->value.i = n | (subimage << 8);
return 2; /* We have consumed 2 bytes */
@@ -1382,7 +1386,7 @@ static void load_wps_bitmaps(struct wps_data *wps_data, char *bmpdir)
*loaded = true;
/* Calculate and store height if this image has sub-images */
- if (n < MAX_IMAGES)
+ if (n < MAX_IMAGES)
wps_data->img[n].subimage_height = wps_data->img[n].bm.height /
wps_data->img[n].num_subimages;
}