From 95f1f0ec4b8b633d1c4381d293cb2218b9686781 Mon Sep 17 00:00:00 2001 From: bibi samina Date: Wed, 26 Aug 2026 14:36:14 +0530 Subject: [PATCH] fix heap overflow in simpleover sprite_op Signed-off-by: bibi samina --- contrib/examples/simpleover.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/contrib/examples/simpleover.c b/contrib/examples/simpleover.c index c226af6627..d19cc31a48 100644 --- a/contrib/examples/simpleover.c +++ b/contrib/examples/simpleover.c @@ -186,8 +186,11 @@ sprite_op(const struct sprite *sprite, int x_offset, int y_offset, out_pixel[3] = in_pixel[3]; } } - } while (++x < image->width); - } while (++y < image->height); + /* Stop at the right edge of the sprite; the input is truncated to + * the sprite area rather than written beyond sprite->buffer. + */ + } while (++x < image->width && (unsigned)(x + x_offset) < sprite->width); + } while (++y < image->height && (unsigned)(y + y_offset) < sprite->height); } }