evas vg: preventing an integer underflow 29/257829/1 submit/tizen/20210504.071041
authorMira Grudzinska <m.grudzinska@samsung.com>
Tue, 4 May 2021 00:29:03 +0000 (02:29 +0200)
committerMira Grudzinska <m.grudzinska@samsung.com>
Tue, 4 May 2021 00:29:03 +0000 (02:29 +0200)
In the evas_vg_shape_path_set API the array size check
was added, before the current point assignment.

Change-Id: I5b24ac60c20bba94bf16e8d96b85f1769cda2b45

src/lib/evas/canvas/efl_canvas_vg_shape.c

index cedb8b2..a34277f 100644 (file)
@@ -1168,7 +1168,7 @@ evas_vg_shape_path_set(Evas_Vg_Shape *obj, const Evas_Vg_Path_Command *op, const
 
    Efl_Canvas_Vg_Shape_Data *sd = _get_shape_data(obj);
    if (!sd) return;
-   _assign_current_point(sd, NULL, points[pts_length - 2], points[pts_length - 1]);
+   if (pts_length >= 2) _assign_current_point(sd, NULL, points[pts_length - 2], points[pts_length - 1]);
 #else
    efl_gfx_path_set(obj, (const Efl_Gfx_Path_Command *)op, points);
 #endif