Skip to content

Clamp Amiga DrawPixel plane count to prevent stack buffer overflow #113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
segrax merged 1 commit into from
May 24, 2026
Merged

Clamp Amiga DrawPixel plane count to prevent stack buffer overflow #113

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions Source/Amiga/Graphics_Amiga.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1348,7 +1348,12 @@ void cGraphics_Amiga::Recruit_Sprite_Draw(int16 pRows, int16 pColumns, int16 pD2
}

void cGraphics_Amiga::DrawPixel(uint8* pSource, uint8* pDestination, uint16 pSourceX, uint16 pSourceY, uint16 pX, uint16 pY) {
uint8 Planes[5] = { 0, 0, 0, 0, 0 };
constexpr uint8 MaxSupportedPlanes = 5;
uint8 Planes[MaxSupportedPlanes] = { 0, 0, 0, 0, 0 };
uint8 PlaneCount = mBMHD_Current->mPlanes;

if (PlaneCount > MaxSupportedPlanes)
PlaneCount = MaxSupportedPlanes;

pSource += (pSourceX / 8);
pSource += (pSourceY * 40);
Expand All @@ -1358,7 +1363,7 @@ void cGraphics_Amiga::DrawPixel(uint8* pSource, uint8* pDestination, uint16 pSou


// Load bits for all planes
for (uint8 Plane = 0; Plane < mBMHD_Current->mPlanes; ++Plane)
for (uint8 Plane = 0; Plane < PlaneCount; ++Plane)
Planes[Plane] = *(pSource + ((mBMHD_Current->mHeight * 40) * Plane));

// Loop each pixel
Expand All @@ -1367,7 +1372,7 @@ void cGraphics_Amiga::DrawPixel(uint8* pSource, uint8* pDestination, uint16 pSou
uint8 Result = 0;

// Value for each plane
for (uint8 Plane = 0; Plane < mBMHD_Current->mPlanes; ++Plane) {
for (uint8 Plane = 0; Plane < PlaneCount; ++Plane) {
Result |= Planes[Plane] & Bit ? (1 << Plane) : 0;
}

Expand Down
Loading