0014-tload: Prevent a buffer overflow when row equals nrows.

When max_scale is very small, scale_fact is very small, row is equal to
nrows, p points outside screen, and the write to *p is out-of-bounds.
This commit is contained in:
Qualys Security Advisory 1970-01-01 00:00:00 +00:00 committed by Craig Small
parent 44593c5e99
commit 44d5a5689c

View File

@ -189,7 +189,7 @@ int main(int argc, char **argv)
for (i = 1;; ++i) {
char *p;
row = nrows - (i * scale_fact);
if (row < 0)
if (row < 0 || row >= nrows)
break;
if (*(p = screen + row * ncols + col) == ' ')
*p = '-';