better validate numeric hatch values for fills

diff --git a/Changes b/Changes
index 82644d7..27b0f41 100644 (file)
--- a/Changes
+++ b/Changes
@@ -21,6 +21,11 @@ Coverity finally finished a build, fix a few problems:
  - addi style makemap could potentially read one past the end of an
    array.
 
+ - supplying a numeric hatch of 32 to Imager::Fill->new(hatch => ...)
+   would result in read beyond the end of the built-in hatch array.
+   Negative values (which Coverity didn't complain about) could also
+   cause problems.
+
 Imager 1.008 - 31 Dec 2018
 ============
 

diff --git a/fills.c b/fills.c
index 52c51c8..479f9d4 100644 (file)
--- a/fills.c
+++ b/fills.c
@@ -672,8 +672,10 @@ i_new_hatch_low(const i_color *fg, const i_color *bg,
     memcpy(fill->hatch, cust_hatch, 8);
   }
   else {
-    if (hatch > sizeof(builtin_hatches)/sizeof(*builtin_hatches)) 
+    if (hatch >= sizeof(builtin_hatches)/sizeof(*builtin_hatches)
+       || hatch < 0) {
       hatch = 0;
+    }
     memcpy(fill->hatch, builtin_hatches[hatch], 8);
   }
   fill->dx = dx & 7;