From 01265c1b08823a729d353c15d14febe6d761df64 Mon Sep 17 00:00:00 2001 From: jdgleaver Date: Mon, 1 Feb 2021 16:43:44 +0000 Subject: [PATCH] (XMB) Fix stack-buffer-overflow due to incorrect data type being passed by reference --- menu/drivers/xmb.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/menu/drivers/xmb.c b/menu/drivers/xmb.c index b1ae2eafbe..e2c110f696 100644 --- a/menu/drivers/xmb.c +++ b/menu/drivers/xmb.c @@ -3826,7 +3826,9 @@ static int xmb_menu_entry_action( static void xmb_render(void *data, unsigned width, unsigned height, bool is_idle) { - unsigned i; + /* 'i' must be of 'size_t', since it is passed + * by reference to menu_entries_ctl() */ + size_t i; float scale_factor; xmb_handle_t *xmb = (xmb_handle_t*)data; settings_t *settings = config_get_ptr(); @@ -3881,7 +3883,7 @@ static void xmb_render(void *data, xmb_calculate_visible_range(xmb, height, end, (unsigned)selection, &first, &last); - for (i = first; i <= last; i++) + for (i = (size_t)first; i <= (size_t)last; i++) { float entry_size = (i == (unsigned)selection) ? xmb->icon_spacing_vertical * xmb->active_item_factor : xmb->icon_spacing_vertical;