elm - table - protect against invalid cell/row values (16bit overflow)

diff --git a/src/lib/elm_table.c b/src/lib/elm_table.c
index da487c386b915157754bc61a1109eced4c5b3a63..7166fcc5be9ea909ee6ee8dcb86b24af3fa77c18 100644 (file)
--- a/src/lib/elm_table.c
+++ b/src/lib/elm_table.c
@@ -343,6 +343,45 @@ _pack(Eo *obj, void *_pd EINA_UNUSED, va_list *list)
    int rowspan = va_arg(*list, int);
    ELM_WIDGET_DATA_GET_OR_RETURN(obj, wd);
 
+   if (col < 0)
+     {
+        ERR("col < 0");
+        return;
+     }
+   if (colspan < 1)
+     {
+        ERR("colspan < 1");
+        return;
+     }
+   if ((0xffff - col) < colspan)
+     {
+        ERR("col + colspan > 0xffff");
+        return;
+     }
+   if ((col + colspan) >= 0x7ffff)
+     {
+        WRN("col + colspan getting rather large (>32767)");
+     }
+   if (row < 0)
+     {
+        ERR("row < 0");
+        return;
+     }
+   if (rowspan < 1)
+     {
+        ERR("rowspan < 1");
+        return;
+     }
+   if ((0xffff - row) < rowspan)
+     {
+        ERR("row + rowspan > 0xffff");
+        return;
+     }
+   if ((row + rowspan) >= 0x7ffff)
+     {
+        WRN("row + rowspan getting rather large (>32767)");
+     }
+   
    elm_widget_sub_object_add(obj, subobj);
    evas_object_table_pack(wd->resize_obj, subobj, col, row, colspan, rowspan);
 }

diff --git a/src/lib/elm_table_legacy.h b/src/lib/elm_table_legacy.h
index 77dda3accf112cc68e3b79a60d70c9d1b2ec2f35..27e06efd8ce6b739926c4035dbef5a68883b425a 100644 (file)
--- a/src/lib/elm_table_legacy.h
+++ b/src/lib/elm_table_legacy.h
@@ -68,6 +68,12 @@ EAPI void      elm_table_padding_get(const Evas_Object *obj, Evas_Coord *horizon
  * a value of 0 for x and y, means the top left cell of the table, and a
  * value of 1 for w and h means @p subobj only takes that 1 cell.
  *
+ * Note that columns and rows only guarantee 16bit unsigned values at best.
+ * That means that col + colspan AND row + rowspan must fit inside 16bit
+ * unsigned values cleanly. You will be warned once values exceed 15bit
+ * storage, and attempting to use values not able to fit in 16bits will
+ * result in failure.
+ * 
  * @ingroup Table
  */
 EAPI void      elm_table_pack(Evas_Object *obj, Evas_Object *subobj, int col, int row, int colspan, int rowspan);