From 4b84cd27b272de517bd5e42fe562653aab034569 Mon Sep 17 00:00:00 2001
From: Bertrand Songis <bsongis@gmail.com>
Date: Mon, 21 Nov 2016 18:40:22 +0100
Subject: [PATCH] [Horus] Protection against buffer overflow

---
 radio/src/gui/480x272/bitmapbuffer.h | 5 +++--
 radio/src/gui/480x272/lcd.h          | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/radio/src/gui/480x272/bitmapbuffer.h b/radio/src/gui/480x272/bitmapbuffer.h
index 190cc7317..d9e1de13c 100644
--- a/radio/src/gui/480x272/bitmapbuffer.h
+++ b/radio/src/gui/480x272/bitmapbuffer.h
@@ -198,7 +198,8 @@ class BitmapBuffer: public BitmapBufferBase<uint16_t>
     template<class T>
     void drawBitmap(coord_t x, coord_t y, const T * bmp, coord_t srcx=0, coord_t srcy=0, coord_t w=0, coord_t h=0, float scale=0)
     {
-      if (!bmp) return;
+      if (!bmp || x >= width || y >= height)
+        return;
 
       int srcw = bmp->getWidth();
       int srch = bmp->getHeight();
@@ -211,7 +212,7 @@ class BitmapBuffer: public BitmapBufferBase<uint16_t>
         w = srcw - srcx;
       if (srcy+h > srch)
         h = srch - srcy;
-
+      
       if (scale == 0) {
         if (x + w > width) {
           w = width - x;
diff --git a/radio/src/gui/480x272/lcd.h b/radio/src/gui/480x272/lcd.h
index 9ab2ec13a..2abcfbcd4 100644
--- a/radio/src/gui/480x272/lcd.h
+++ b/radio/src/gui/480x272/lcd.h
@@ -77,6 +77,7 @@ enum FontSizeIndex {
   SPAREf_INDEX,
 };
 
+#define STDSIZE                        (STDSIZE_INDEX << 8)
 #define TINSIZE                        (TINSIZE_INDEX << 8)
 #define SMLSIZE                        (SMLSIZE_INDEX << 8)
 #define MIDSIZE                        (MIDSIZE_INDEX << 8)