diff options
| author | Xavier Del Campo Romero <xavi.dcr@tutanota.com> | 2020-11-07 16:00:08 +0100 |
|---|---|---|
| committer | Xavier Del Campo Romero <xavi.dcr@tutanota.com> | 2020-11-07 16:03:06 +0100 |
| commit | d3780c0d7d45e64531c16f916e9ea088ccc59998 (patch) | |
| tree | 3a62e99549af0a8b5467f4edba09197952f0709f /libpsx/src/gpu.c | |
| parent | d9acf265ff96e0a1f8e882f55d25414ec0ce430b (diff) | |
| download | psxsdk-d3780c0d7d45e64531c16f916e9ea088ccc59998.tar.gz | |
Fix buffer overflow on GsLoadFont
LoadImage accesses img[0..15] when w=16, h=1, causing it to read past `pal`.
Diffstat (limited to 'libpsx/src/gpu.c')
| -rw-r--r-- | libpsx/src/gpu.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libpsx/src/gpu.c b/libpsx/src/gpu.c index 6a59c72..beb6560 100644 --- a/libpsx/src/gpu.c +++ b/libpsx/src/gpu.c @@ -1045,7 +1045,7 @@ void GsSetDispEnvSimple(int x, int y) void GsLoadFont(int fb_x, int fb_y, int cx, int cy) { - unsigned short pal[2] = {0x0, 0x7fff}; + const unsigned short pal[16] = {0x0, 0x7fff}; LoadImage(psxsdk_font_data, fb_x, fb_y, 16, 128); while(GsIsDrawing()); |