From 217a1f1f7ff376420eda43f0f0f7c000f75bc085 Mon Sep 17 00:00:00 2001 From: Stuart Longland Date: Fri, 11 Jan 2008 14:34:55 +1000 Subject: [PATCH] Restrict input parameter ranges. --- src/main.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/main.c b/src/main.c index b2b8b7e..91e505d 100644 --- a/src/main.c +++ b/src/main.c @@ -248,12 +248,24 @@ void photo_handler( struct gallery_info* gallery, int width = hdf_get_int_value( cgi->hdf, "Query.width", 720 ); int height = hdf_get_int_value( cgi->hdf, "Query.height", 0 ); int quality = hdf_get_int_value( cgi->hdf, "Query.quality", 60 ); + + /* MAX SIZE: Allow images no bigger than a 2048 pixel square */ + if ( width > 2048 ) width = 2048; + if ( height > 2048 ) height = 2048; + + /* Prevent nonsense values */ + if ( width < 0 ) width = 0; + if ( height < 0 ) height = 0; + if ( quality < 0 ) quality = 0; + if ( quality > 100 ) quality = 100; /* Since ClearSilver doesn't provide a 'get float', we have to get * string then call atof on it. */ char* rotation_str = hdf_get_value( cgi->hdf, "Query.rotation", "0" ); double rotation = atof( rotation_str ); + if ( ( rotation < -360.0 ) || ( rotation > 360.0 ) ) + rotation = rotation % 360.0 dprintf("photo_handler: asked for %dx%d image " "at %fdeg rotation and %d quality\n",