starred/OpenEPaperLink
1
0
Fork 0
mirror of https://github.com/OpenEPaperLink/OpenEPaperLink.git synced 2026-03-21 03:04:25 +01:00
Code Issues 649 Packages Projects Releases 10 Wiki Activity

Fix buffer size truncation for non-8-aligned image dimensions (#561)

Browse Source 
Integer division (w*h)/8 truncates when w*h is not a multiple of 8,
allocating one byte too few. spr2color then writes past the end of
the buffer, corrupting the heap. Use (w*h+7)/8 to round up correctly.

Triggered by any tag whose width*height is not divisible by 8.
This commit is contained in:
Nick Waterton
2026-03-13 14:35:17 -04:00
committed by GitHub
parent e62a1b07bf
commit d5e19d20fa
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ESP32_AP-Flasher/src/makeimage.cpp
View File

@@ -461,7 +461,7 @@ void spr2buffer(TFT_eSprite &spr, String &fileout, imgParam &imageParams) {
case 1: case 1:
case 2: { case 2: {
long bufw = spr.width(), bufh = spr.height(); long bufw = spr.width(), bufh = spr.height();
size_t buffer_size = (bufw * bufh) / 8; size_t buffer_size = ((bufw * bufh) + 7) / 8; // round up: not all dimensions are multiples of 8
#ifdef BOARD_HAS_PSRAM #ifdef BOARD_HAS_PSRAM
uint8_t *buffer = (uint8_t *)ps_malloc(buffer_size); uint8_t *buffer = (uint8_t *)ps_malloc(buffer_size);
#else #else
@@ -585,7 +585,7 @@ void spr2buffer(TFT_eSprite &spr, String &fileout, imgParam &imageParams) {
case 3: case 3:
case 4: { case 4: {
long bufw = spr.width(), bufh = spr.height(); long bufw = spr.width(), bufh = spr.height();
size_t buffer_size = (bufw * bufh) / 8 * imageParams.bpp; size_t buffer_size = ((bufw * bufh) + 7) / 8 * imageParams.bpp;
uint8_t *buffer = (uint8_t *)ps_malloc(buffer_size); uint8_t *buffer = (uint8_t *)ps_malloc(buffer_size);
if (!buffer) { if (!buffer) {
Serial.println("Failed to allocate buffer"); Serial.println("Failed to allocate buffer");