From 04a4e8a38dcbbce97a46b1980d9d505d095a2404 Mon Sep 17 00:00:00 2001 From: Scott Shawcroft Date: Fri, 5 Apr 2019 13:10:47 -0700 Subject: Always check TileGrid's x, y When using an int index you could end up writing past the end of TileGrid's memory. Fixes #1747 --- shared-bindings/displayio/TileGrid.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/shared-bindings/displayio/TileGrid.c b/shared-bindings/displayio/TileGrid.c index a45feaec4..7c2c0d4cc 100644 --- a/shared-bindings/displayio/TileGrid.c +++ b/shared-bindings/displayio/TileGrid.c @@ -259,9 +259,10 @@ STATIC mp_obj_t tilegrid_subscr(mp_obj_t self_in, mp_obj_t index_obj, mp_obj_t v mp_obj_get_array_fixed_n(index_obj, 2, &items); x = mp_obj_get_int(items[0]); y = mp_obj_get_int(items[1]); - if (x >= common_hal_displayio_tilegrid_get_width(self) || y >= common_hal_displayio_tilegrid_get_height(self)) { - mp_raise_IndexError(translate("tile index out of bounds")); - } + } + if (x >= common_hal_displayio_tilegrid_get_width(self) || + y >= common_hal_displayio_tilegrid_get_height(self)) { + mp_raise_IndexError(translate("tile index out of bounds")); } if (value_obj == MP_OBJ_SENTINEL) { -- cgit v1.2.3