github-code/lvgl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(roller): fix stringop overflow (#6826)

Browse Source 
Signed-off-by: pengyiqiang <pengyiqiang@xiaomi.com>
Co-authored-by: pengyiqiang <pengyiqiang@xiaomi.com>
This commit is contained in:
VIFEX
2024-09-11 14:04:20 +08:00
committed by Gabor Kiss-Vamosi
parent 0d483105e9
commit ca8e23d934
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/widgets/roller/lv_roller.c
View File

@@ -158,13 +158,19 @@ void lv_roller_set_options(lv_obj_t * obj, const char * options, lv_roller_mode_
LV_LOG_INFO("Using %" LV_PRIu32 " pages to make the roller look infinite", roller->inf_page_cnt); LV_LOG_INFO("Using %" LV_PRIu32 " pages to make the roller look infinite", roller->inf_page_cnt);
size_t opt_len = lv_strlen(options) + 1; /*+1 to add '\n' after option lists*/ size_t opt_len = lv_strlen(options) + 1; /*+1 to add '\n' after option lists*/
char * opt_extra = lv_malloc(opt_len * roller->inf_page_cnt); size_t opt_extra_len = opt_len * roller->inf_page_cnt;
if(opt_extra_len == 0) {
/*Prevent write overflow*/
opt_extra_len = 1;
}
char * opt_extra = lv_malloc(opt_extra_len);
uint32_t i; uint32_t i;
for(i = 0; i < roller->inf_page_cnt; i++) { for(i = 0; i < roller->inf_page_cnt; i++) {
lv_strcpy(&opt_extra[opt_len * i], options); lv_strcpy(&opt_extra[opt_len * i], options);
opt_extra[opt_len * (i + 1) - 1] = '\n'; opt_extra[opt_len * (i + 1) - 1] = '\n';
} }
opt_extra[opt_len * roller->inf_page_cnt - 1] = '\0'; opt_extra[opt_extra_len - 1] = '\0';
lv_label_set_text(label, opt_extra); lv_label_set_text(label, opt_extra);
lv_free(opt_extra); lv_free(opt_extra);