From 9acf6d31cfd9c3f21d8c42e6ceda1c65d74be05f Mon Sep 17 00:00:00 2001
From: Richard Wilson <rjw@netsurf-browser.org>
Date: Tue, 5 Apr 2005 17:19:58 +0000
Subject: [project @ 2005-04-05 17:19:58 by rjw] Add sanity checks to Sprite
 file handling and simplify code.

svn path=/import/netsurf/; revision=1600
---
 content/content.c |  2 +-
 riscos/sprite.c   | 33 +++++++++------------------------
 riscos/sprite.h   |  3 ---
 3 files changed, 10 insertions(+), 28 deletions(-)

diff --git a/content/content.c b/content/content.c
index b80d5de89..4b58e188f 100644
--- a/content/content.c
+++ b/content/content.c
@@ -195,7 +195,7 @@ static const struct handler_entry handler_map[] = {
 		0, nsmng_destroy, 0, nsmng_redraw, 0, 0, false},
 #endif
 #ifdef WITH_SPRITE
-	{sprite_create, 0, sprite_convert,
+	{0, 0, sprite_convert,
 		0, sprite_destroy, 0, sprite_redraw, 0, 0, false},
 #endif
 #ifdef WITH_DRAW
diff --git a/riscos/sprite.c b/riscos/sprite.c
index 837dedfbe..27bc4f8af 100644
--- a/riscos/sprite.c
+++ b/riscos/sprite.c
@@ -30,28 +30,6 @@
 #ifdef WITH_SPRITE
 
 
-/**
- * Create a new CONTENT_SPRITE.
- *
- * A new empty sprite area is allocated.
- */
-
-bool sprite_create(struct content *c, const char *params[])
-{
-	union content_msg_data msg_data;
-
-	c->data.sprite.data = malloc(4);
-	if (!c->data.sprite.data) {
-		msg_data.error = messages_get("NoMemory");
-		content_broadcast(c, CONTENT_MSG_ERROR, msg_data);
-		warn_user("NoMemory", 0);
-		return false;
-	}
-	c->data.sprite.length = 4;
-	return true;
-}
-
-
 /**
  * Convert a CONTENT_SPRITE for display.
  *
@@ -68,6 +46,13 @@ bool sprite_convert(struct content *c, int width, int height)
 	source_data = ((char *)c->source_data) - 4;
 	osspriteop_area *area = (osspriteop_area*)source_data;
 	c->data.sprite.data = area;
+	
+	/* check for bad data */
+	if ((int)c->source_size + 4 != area->used) {
+		msg_data.error = messages_get("BadSprite");
+		content_broadcast(c, CONTENT_MSG_ERROR, msg_data);
+		return false;
+	}
 
 	error = xosspriteop_read_sprite_info(osspriteop_PTR,
 			(osspriteop_area *)0x100,
@@ -86,7 +71,7 @@ bool sprite_convert(struct content *c, int width, int height)
 	c->title = malloc(100);
 	if (c->title)
 		snprintf(c->title, 100, messages_get("SpriteTitle"), c->width,
-				c->height, c->data.sprite.length);
+				c->height, c->source_size);
 	c->status = CONTENT_STATUS_DONE;
 	return true;
 }
@@ -99,7 +84,7 @@ bool sprite_convert(struct content *c, int width, int height)
 void sprite_destroy(struct content *c)
 {
 	/* do not free c->data.sprite.data at it is simply a pointer to
-	 * 4 bytes before the c->data.source_data. */
+	 * 4 bytes beforec->source_data. */
 	free(c->title);
 }
 
diff --git a/riscos/sprite.h b/riscos/sprite.h
index 3824ace43..f360d2bb0 100644
--- a/riscos/sprite.h
+++ b/riscos/sprite.h
@@ -18,11 +18,8 @@ struct content;
 
 struct content_sprite_data {
 	void *data;
-	unsigned long length;
 };
 
-bool sprite_create(struct content *c, const char *params[]);
-bool sprite_process_data(struct content *c, char *data, unsigned int size);
 bool sprite_convert(struct content *c, int width, int height);
 void sprite_destroy(struct content *c);
 bool sprite_redraw(struct content *c, int x, int y,
-- 
cgit v1.2.3