[Freeciv-Dev] (PR#12360) specfile specifies out-of-range sprite

["Jason Short" <jdorje@xxxxxxxxxxxxxxxxxxxxx>]

<URL: http://bugs.freeciv.org/Ticket/Display.html?id=12360 >

If the specfile specifies a location on the file for a sprite to be, and 
that location is outside of the file, then the result isn't very good.

I don't know what the result is in 2.0.  In 2.0.99 the gtk2 client will 
crash inside of crop sprite (thanks to pixbufs).

Any time this happens I'm sure it's unintentional.  For instance it 
happens in explosions.spec in r-hires.  This patch catches the error in 
tilespec.c, reports an error, and simply returns the sprite as NULL.

Written for 2.0.99 but it probably applies to 2.0 also.

-jason

? vgcore.pid17167
? vgcore.pid17188
Index: client/tilespec.c
===================================================================
RCS file: /home/freeciv/CVS/freeciv/client/tilespec.c,v
retrieving revision 1.242
diff -u -r1.242 tilespec.c
--- client/tilespec.c   26 Feb 2005 00:54:39 -0000      1.242
+++ client/tilespec.c   26 Feb 2005 07:26:15 -0000
@@ -3513,7 +3513,17 @@
        exit(EXIT_FAILURE);
       }
     } else {
+      int sf_w, sf_h;
+
       ensure_big_sprite(ss->sf);
+      get_sprite_dimensions(ss->sf->big_sprite, &sf_w, &sf_h);
+      if (ss->x < 0 || ss->x + ss->width > sf_w
+         || ss->y < 0 || ss->y + ss->height > sf_h) {
+       freelog(LOG_ERROR,
+               "Sprite '%s' in file '%s' isn't within the image!",
+               tag_name, ss->sf->file_name);
+       return NULL;
+      }
       ss->sprite =
        crop_sprite(ss->sf->big_sprite, ss->x, ss->y, ss->width, ss->height,
                    NULL, -1, -1);