Add some range checking based on testing in Fusil.

mdboom · mdboom · commit 2bb054c51b17 · 2008-07-10T18:12:50.000Z
svn path=/trunk/matplotlib/; revision=5733
diff --git a/src/_backend_agg.cpp b/src/_backend_agg.cpp
@@ -1611,10 +1611,26 @@ Py::Object _backend_agg_module::new_renderer (const Py::Tuple &args,
   if ( kws.hasKey("debug") ) debug = Py::Int( kws["debug"] );
   else debug=0;
 
-  int width = Py::Int(args[0]);
-  int height = Py::Int(args[1]);
+  unsigned int width = (unsigned int)Py::Int(args[0]);
+  unsigned int height = (unsigned int)Py::Int(args[1]);
   double dpi = Py::Float(args[2]);
-  return Py::asObject(new RendererAgg(width, height, dpi, debug));
+
+  if (width > 1 << 15 || height > 1 << 15) {
+    throw Py::ValueError("width and height must each be below 32768");
+  }
+
+  if (dpi <= 0.0) {
+    throw Py::ValueError("dpi must be positive");
+  }
+
+  RendererAgg* renderer = NULL;
+  try {
+    renderer = new RendererAgg(width, height, dpi, debug);
+  } catch (std::bad_alloc) {
+    throw Py::RuntimeError("Could not allocate memory for image");
+  }
+
+  return Py::asObject(renderer);
 }
 
 
diff --git a/src/_image.cpp b/src/_image.cpp
@@ -708,8 +708,12 @@ _image_module::from_images(const Py::Tuple& args) {
 
   args.verify_length(3);
 
-  size_t numrows = Py::Int(args[0]);
-  size_t numcols = Py::Int(args[1]);
+  size_t numrows = (size_t)Py::Int(args[0]);
+  size_t numcols = (size_t)Py::Int(args[1]);
+
+  if (numrows > 1 << 15 || numcols > 1 << 15) {
+    throw Py::RuntimeError("numrows and numcols must both be less than 32768");
+  }
 
   Py::SeqBase<Py::Object> tups = args[2];
   size_t N = tups.length();
@@ -1084,8 +1088,13 @@ _image_module::frombuffer(const Py::Tuple& args) {
   args.verify_length(4);
 
   PyObject *bufin = new_reference_to(args[0]);
-  int x = Py::Int(args[1]);
-  int y = Py::Int(args[2]);
+  size_t x = Py::Int(args[1]);
+  size_t y = Py::Int(args[2]);
+
+  if (x > 1 << 15 || y > 1 << 15) {
+    throw Py::ValueError("x and y must both be less than 32768");
+  }
+
   int isoutput = Py::Int(args[3]);
 
   if (PyObject_CheckReadBuffer(bufin) != 1)
@@ -1155,6 +1164,10 @@ _image_module::pcolor(const Py::Tuple& args) {
   unsigned int cols = Py::Int(args[4]);
   Py::Tuple bounds = args[5];
 
+  if (rows > 1 << 15 || cols > 1 << 15) {
+    throw Py::ValueError("rows and cols must both be less than 32768");
+  }
+
   if (bounds.length() !=4)
       throw Py::TypeError("Incorrect number of bounds (4 expected)");
   float x_min = Py::Float(bounds[0]);
@@ -1391,6 +1404,10 @@ _image_module::pcolor2(const Py::Tuple& args) {
     Py::Tuple bounds = args[5];
     Py::Object bgp = args[6];
 
+    if (rows > 1 << 15 || cols > 1 << 15) {
+      throw Py::ValueError("rows and cols must both be less than 32768");
+    }
+
     if (bounds.length() !=4)
         throw Py::TypeError("Incorrect number of bounds (4 expected)");
     double x_left = Py::Float(bounds[0]);
