@@ -240,34 +240,54 @@ buffer_create(struct interactive_dpy *inter, uint32_t width, uint32_t height)
240240 break ;
241241 default :
242242 fprintf (stderr , "Unsupported SHM format %d\n" , inter -> shm_format );
243- exit (1 );
243+ exit (EXIT_FAILURE );
244244 }
245245
246- size = stride * height ;
247- fd = os_create_anonymous_file (size );
246+ size = (size_t )(stride ) * height ;
247+
248+ const off_t offset = (off_t ) size ;
249+ if ((size_t ) offset != size ) {
250+ fprintf (stderr , "Couldn't create surface buffer (buffer size error)\n" );
251+ exit (EXIT_FAILURE );
252+ }
253+
254+ fd = os_create_anonymous_file (offset );
248255 if (fd < 0 ) {
249- fprintf (stderr , "Couldn't create surface buffer\n" );
250- exit (1 );
256+ fprintf (stderr , "Couldn't create surface buffer (buffer file error) \n" );
257+ exit (EXIT_FAILURE );
251258 }
252259
253260 map = mmap (NULL , size , PROT_READ | PROT_WRITE , MAP_SHARED , fd , 0 );
254261 if (map == MAP_FAILED ) {
255262 fprintf (stderr , "Couldn't mmap surface buffer\n" );
256- exit (1 );
263+ exit (EXIT_FAILURE );
257264 }
258265 memset (map , 0xff , size );
259266 munmap (map , size );
260267
261- pool = wl_shm_create_pool (inter -> shm , fd , size );
262- buf = wl_shm_pool_create_buffer (pool , 0 , width , height , stride ,
268+ if (size > INT32_MAX ) {
269+ fprintf (stderr , "Couldn't create surface pool\n" );
270+ exit (EXIT_FAILURE );
271+ }
272+ pool = wl_shm_create_pool (inter -> shm , fd , (int32_t ) size );
273+
274+ if (width > INT32_MAX || height > INT32_MAX || stride > INT32_MAX ) {
275+ fprintf (stderr , "Couldn't create surface pool buffer\n" );
276+ exit (EXIT_FAILURE );
277+ }
278+ const int32_t iwidth = (int32_t ) width ;
279+ const int32_t iheight = (int32_t ) height ;
280+ const int32_t istride = (int32_t ) stride ;
281+
282+ buf = wl_shm_pool_create_buffer (pool , 0 , iwidth , iheight , istride ,
263283 inter -> shm_format );
264284 wl_buffer_add_listener (buf , & buffer_listener , inter );
265285
266286 wl_surface_attach (inter -> wl_surf , buf , 0 , 0 );
267- wl_surface_damage (inter -> wl_surf , 0 , 0 , width , height );
287+ wl_surface_damage (inter -> wl_surf , 0 , 0 , iwidth , iheight );
268288
269289 opaque = wl_compositor_create_region (inter -> compositor );
270- wl_region_add (opaque , 0 , 0 , width , height );
290+ wl_region_add (opaque , 0 , 0 , iwidth , iheight );
271291 wl_surface_set_opaque_region (inter -> wl_surf , opaque );
272292 wl_region_destroy (opaque );
273293
0 commit comments