From 14f95d124b3fb80ff329b55c168a845e44f38c08 Mon Sep 17 00:00:00 2001 From: Tim Gleason Date: Wed, 5 Aug 2026 14:11:07 -0400 Subject: [PATCH] Fix buffer overrun in Paint_Clear() at Scale 65 The inner loop was bounded by Paint.WidthByte, which Paint_SetScale(65) sets to WidthMemory*2 - a byte count, not a pixel count. Combined with the Addr = X*2 below it, each row wrote 1280 bytes on a 640-byte stride (at width 320), so the final row ran 2*width bytes past the end of the caller's buffer. The overrun happens for every width and height, on every call. Bounding the loop by Paint.WidthMemory counts pixels, which is what the body expects, and still covers the buffer exactly with no gaps. --- c/lib/GUI/GUI_Paint.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/c/lib/GUI/GUI_Paint.c b/c/lib/GUI/GUI_Paint.c index e6e6b0b..9bb73f4 100644 --- a/c/lib/GUI/GUI_Paint.c +++ b/c/lib/GUI/GUI_Paint.c @@ -214,7 +214,7 @@ void Paint_Clear(UWORD Color) } }else if(Paint.Scale == 65) { for (UWORD Y = 0; Y < Paint.HeightByte; Y++) { - for (UWORD X = 0; X < Paint.WidthByte; X++ ) {//8 pixel = 1 byte + for (UWORD X = 0; X < Paint.WidthMemory; X++ ) {//1 pixel = 2 bytes UDOUBLE Addr = X*2 + Y*Paint.WidthByte; Paint.Image[Addr] = 0xff & (Color>>8); Paint.Image[Addr+1] = 0xff & Color;