Skip to content

One method to fix the NaN/INT_MAX segfault in blit #2893

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 9 commits into from
12 changes: 12 additions & 0 deletions src_c/surface.c
Original file line number Diff line number Diff line change
Expand Up @@ -3828,6 +3828,18 @@ pgSurface_Blit(pgSurfaceObject *dstobj, pgSurfaceObject *srcobj,
SDL_Rect orig_clip, sub_clip;
Uint8 alpha;

if ((dstrect->x <= INT_MIN) || (dstrect->x >= INT_MAX) ||
(dstrect->y <= INT_MIN) || (dstrect->y >= INT_MAX)) {
// destination position has values that are too large
return 0;
}
if (srcrect != NULL &&
((srcrect->x <= INT_MIN) || (srcrect->x >= INT_MAX) ||
(srcrect->y <= INT_MIN) || (srcrect->y >= INT_MAX))) {
// source position has values that are too large:
return 0;
}

/* passthrough blits to the real surface */
if (((pgSurfaceObject *)dstobj)->subsurface) {
PyObject *owner;
Expand Down
44 changes: 44 additions & 0 deletions test/surface_test.py
Original file line number Diff line number Diff line change
Expand Up @@ -1061,6 +1061,50 @@ def test_blit_zero_overlap(self):
) # Remaining corners
self.assertEqual(self.dst_surface.get_at((0, 63)), (0, 0, 0))

def test_blit_bad_frect_position_values(self):
"""Previously segfaulted - these should now silently exit and blit nothing"""

# test the old segfault case - just to make sure it doesn't segfault
screen = pygame.display.set_mode((800, 600))
screen.fill((0, 0, 0))
test_surf = pygame.Surface((1057, 398), flags=pygame.SRCALPHA)
pos_rect = pygame.FRect(float("nan"), 202.0, 100.0, 100.0)
screen.blit(test_surf, pos_rect)

# thoroughly test the fix code
# these parts could be removed or changed once FRect is able to
# handle/reject large values like this
c_max_int = 2147483647
c_min_int = -2147483648
self.dst_surface.blit(
self.src_surface, pygame.FRect(c_max_int, c_max_int, 300, 300)
)

self.assertEqual(self.dst_surface.get_at((0, 0)), (0, 0, 0))
self.assertEqual(self.dst_surface.get_at((63, 63)), (0, 0, 0))

self.dst_surface.blit(
self.src_surface, pygame.FRect(c_min_int, c_min_int, 300, 300)
)

self.assertEqual(self.dst_surface.get_at((0, 0)), (0, 0, 0))
self.assertEqual(self.dst_surface.get_at((63, 63)), (0, 0, 0))

# test area too
self.dst_surface.blit(
self.src_surface, (0, 0), pygame.FRect(c_max_int, c_max_int, 300, 300)
)

self.assertEqual(self.dst_surface.get_at((0, 0)), (0, 0, 0))
self.assertEqual(self.dst_surface.get_at((63, 63)), (0, 0, 0))

self.dst_surface.blit(
self.src_surface, (0, 0), pygame.FRect(c_min_int, c_min_int, 300, 300)
)

self.assertEqual(self.dst_surface.get_at((0, 0)), (0, 0, 0))
self.assertEqual(self.dst_surface.get_at((63, 63)), (0, 0, 0))

def test_blit__SRCALPHA_opaque_source(self):
src = pygame.Surface((256, 256), SRCALPHA, 32)
dst = src.copy()
Expand Down
Loading