Correct an inequality sign causing the bounds check in Windows

palette_set() to be bogus. Fortunately, this isn't exploitable through
the terminal emulator, because the palette escape sequence parser
contains its own bounds check before even calling palette_set().

While I'm at it, fix the same goof in the OS X version! That port is
more or less abandoned, but that's no excuse for leaving obviously
wrong code lying around.

[originally from svn r9965]

diff --git a/macosx/osxwin.m b/macosx/osxwin.m
index 169ae648453b2fe55556ade850307390d4bc3015..b58742d9f65f804cbd69172ab9f4eee19a490b1d 100644 (file)
--- a/macosx/osxwin.m
+++ b/macosx/osxwin.m
@@ -957,7 +957,7 @@ void palette_set(void *frontend, int n, int r, int g, int b)
 
     if (n >= 16)
        n += 256 - 16;
-    if (n > NALLCOLOURS)
+    if (n >= NALLCOLOURS)
        return;
     [win setColour:n r:r/255.0 g:g/255.0 b:b/255.0];
 

diff --git a/windows/window.c b/windows/window.c
index b477d6ae81fda4af6044bef6f6c798d0bdf1a9e3..f1f72525a305a0b6ed34d95f31e26db9df236482 100644 (file)
--- a/windows/window.c
+++ b/windows/window.c
@@ -4805,7 +4805,7 @@ void palette_set(void *frontend, int n, int r, int g, int b)
 {
     if (n >= 16)
        n += 256 - 16;
-    if (n > NALLCOLOURS)
+    if (n >= NALLCOLOURS)
        return;
     real_palette_set(n, r, g, b);
     if (pal) {