@@ -240,34 +240,54 @@ buffer_create(struct interactive_dpy *inter, uint32_t width, uint32_t height)
240
240
break ;
241
241
default :
242
242
fprintf (stderr , "Unsupported SHM format %d\n" , inter -> shm_format );
243
- exit (1 );
243
+ exit (EXIT_FAILURE );
244
244
}
245
245
246
- size = stride * height ;
247
- fd = os_create_anonymous_file (size );
246
+ size = (size_t )(stride ) * height ;
247
+
248
+ const off_t offset = (off_t ) size ;
249
+ if ((size_t ) offset != size ) {
250
+ fprintf (stderr , "Couldn't create surface buffer (buffer size error)\n" );
251
+ exit (EXIT_FAILURE );
252
+ }
253
+
254
+ fd = os_create_anonymous_file (offset );
248
255
if (fd < 0 ) {
249
- fprintf (stderr , "Couldn't create surface buffer\n" );
250
- exit (1 );
256
+ fprintf (stderr , "Couldn't create surface buffer (buffer file error) \n" );
257
+ exit (EXIT_FAILURE );
251
258
}
252
259
253
260
map = mmap (NULL , size , PROT_READ | PROT_WRITE , MAP_SHARED , fd , 0 );
254
261
if (map == MAP_FAILED ) {
255
262
fprintf (stderr , "Couldn't mmap surface buffer\n" );
256
- exit (1 );
263
+ exit (EXIT_FAILURE );
257
264
}
258
265
memset (map , 0xff , size );
259
266
munmap (map , size );
260
267
261
- pool = wl_shm_create_pool (inter -> shm , fd , size );
262
- buf = wl_shm_pool_create_buffer (pool , 0 , width , height , stride ,
268
+ if (size > INT32_MAX ) {
269
+ fprintf (stderr , "Couldn't create surface pool\n" );
270
+ exit (EXIT_FAILURE );
271
+ }
272
+ pool = wl_shm_create_pool (inter -> shm , fd , (int32_t ) size );
273
+
274
+ if (width > INT32_MAX || height > INT32_MAX || stride > INT32_MAX ) {
275
+ fprintf (stderr , "Couldn't create surface pool buffer\n" );
276
+ exit (EXIT_FAILURE );
277
+ }
278
+ const int32_t iwidth = (int32_t ) width ;
279
+ const int32_t iheight = (int32_t ) height ;
280
+ const int32_t istride = (int32_t ) stride ;
281
+
282
+ buf = wl_shm_pool_create_buffer (pool , 0 , iwidth , iheight , istride ,
263
283
inter -> shm_format );
264
284
wl_buffer_add_listener (buf , & buffer_listener , inter );
265
285
266
286
wl_surface_attach (inter -> wl_surf , buf , 0 , 0 );
267
- wl_surface_damage (inter -> wl_surf , 0 , 0 , width , height );
287
+ wl_surface_damage (inter -> wl_surf , 0 , 0 , iwidth , iheight );
268
288
269
289
opaque = wl_compositor_create_region (inter -> compositor );
270
- wl_region_add (opaque , 0 , 0 , width , height );
290
+ wl_region_add (opaque , 0 , 0 , iwidth , iheight );
271
291
wl_surface_set_opaque_region (inter -> wl_surf , opaque );
272
292
wl_region_destroy (opaque );
273
293
0 commit comments