- addi style makemap could potentially read one past the end of an
array.
+ - supplying a numeric hatch of 32 to Imager::Fill->new(hatch => ...)
+ would result in read beyond the end of the built-in hatch array.
+ Negative values (which Coverity didn't complain about) could also
+ cause problems.
+
Imager 1.008 - 31 Dec 2018
============
memcpy(fill->hatch, cust_hatch, 8);
}
else {
- if (hatch > sizeof(builtin_hatches)/sizeof(*builtin_hatches))
+ if (hatch >= sizeof(builtin_hatches)/sizeof(*builtin_hatches)
+ || hatch < 0) {
hatch = 0;
+ }
memcpy(fill->hatch, builtin_hatches[hatch], 8);
}
fill->dx = dx & 7;