Skip to content

Commit

Permalink
Avoid heap-buffer-overflow if xdata of patch object is a row vector (…
Browse files Browse the repository at this point in the history
…bug #66466).

* libinterp/corefcn/graphics.cc (patch::properties::update_fvc): The "xdata"
property of a patch graphics object is allowed to be a row vector (in which
case it is treated like a column vector). In this case, check whether colors
are set per vertex after the input has been transformed to column vectors. This
avoids a potential heap-buffer-overflow when creating the "facevertexcdata" of
the patch graphics object.
  • Loading branch information
mmuetzel committed Nov 20, 2024
1 parent 29d1258 commit b211c94
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions libinterp/corefcn/graphics.cc
Original file line number Diff line number Diff line change
Expand Up @@ -9691,10 +9691,6 @@ patch::properties::update_fvc ()
return;
}

bool pervertex = false;
if (ncv == nv)
pervertex = true;

bool isRGB = false;
if (cd.ndims () == 3)
isRGB = true;
Expand All @@ -9711,6 +9707,10 @@ patch::properties::update_fvc ()
zd = zd.as_column ();
}

bool pervertex = false;
if (ncv == nv)
pervertex = true;

dv(0) = nv * nf;
if (zd.isempty ())
dv(1) = 2;
Expand Down

0 comments on commit b211c94

Please sign in to comment.