diff --git a/src/unix/unix_sdl.c b/src/unix/unix_sdl.c index 3155a3a1e..a61d338e6 100644 --- a/src/unix/unix_sdl.c +++ b/src/unix/unix_sdl.c @@ -133,7 +133,7 @@ sdl_blit_shim(int x, int y, int w, int h) params.y = y; params.w = w; params.h = h; - if (!(!sdl_enabled || (h <= 0) || (buffer32 == NULL) || (sdl_render == NULL) || (sdl_tex == NULL))) memcpy(interpixels, &(buffer32->line[y][x]), h * (2048 + 64) * sizeof(uint32_t)); + if (!(!sdl_enabled || (x < 0) || (y < 0) || (w <= 0) || (h <= 0) || (w > 2048) || (h > 2048) || (buffer32 == NULL) || (sdl_render == NULL) || (sdl_tex == NULL))) memcpy(interpixels, &(buffer32->line[y][x]), h * (2048 + 64) * sizeof(uint32_t)); blitreq = 1; video_blit_complete(); } @@ -174,7 +174,7 @@ sdl_blit(int x, int y, int w, int h) { SDL_Rect r_src; - if (!sdl_enabled || (h <= 0) || (buffer32 == NULL) || (sdl_render == NULL) || (sdl_tex == NULL)) { + if (!sdl_enabled || (x < 0) || (y < 0) || (w <= 0) || (h <= 0) || (w > 2048) || (h > 2048) || (buffer32 == NULL) || (sdl_render == NULL) || (sdl_tex == NULL)) { r_src.x = x; r_src.y = y; r_src.w = w; diff --git a/src/vnc.c b/src/vnc.c index f2f4655b0..371e03803 100644 --- a/src/vnc.c +++ b/src/vnc.c @@ -172,7 +172,7 @@ vnc_blit(int x, int y, int w, int h) uint32_t *p; int yy; - if (h <= 0) + if ((x < 0) || (y < 0) || (w <= 0) || (h <= 0) || (w > 2048) || (h > 2048) || (buffer32 == NULL)) return; for (yy=0; yy 2048) || (h > 2048) || (buffer32 == NULL) || (thread == NULL) || atomic_flag_test_and_set(&blit_info[write_pos].in_use)) { video_blit_complete(); diff --git a/src/win/win_sdl.c b/src/win/win_sdl.c index ffd589ce0..62a77551b 100644 --- a/src/win/win_sdl.c +++ b/src/win/win_sdl.c @@ -234,7 +234,7 @@ sdl_blit(int x, int y, int w, int h) SDL_Rect r_src; int ret; - if (!sdl_enabled || (w <= 0) || (h <= 0) || (w > 2048) || (h > 2048) || (buffer32 == NULL) || (sdl_render == NULL) || (sdl_tex == NULL)) { + if (!sdl_enabled || (x < 0) || (y < 0) || (w <= 0) || (h <= 0) || (w > 2048) || (h > 2048) || (buffer32 == NULL) || (sdl_render == NULL) || (sdl_tex == NULL)) { video_blit_complete(); return; }