Commit Graph

2 Commits (24cf1f0f9aeddf7f7dc402928db5f7d1c83caa9c)

Author SHA1 Message Date
Pierre Ossman 1224cbdc21 Handle empty Tight gradient rects
We always assumed there would be one pixel per row so a rect with
a zero width would result in us writing to unknown memory.

This could theoretically be used by a malicious server to inject
code in to the viewer process.

Issue found by Pavel Cheremushkin from Kaspersky Lab.
5 years ago
matt 408c005d3e Initial commit 5 years ago