* skins2: Fixed a crash occurring when a SubBitmap was specifying invalid

   coordinates and/or invalid size

modules/gui/skins2/parser/builder.cpp

@@ -165,9 +165,15 @@ void Builder::addSubBitmap( const BuilderData::SubBitmap &rData )
     // Copy a region of the parent bitmap to the new one
     BitmapImpl *pBmp =
         new BitmapImpl( getIntf(), rData.m_width, rData.m_height );
-    pBmp->drawBitmap( *pParentBmp, rData.m_x, rData.m_y, 0, 0, rData.m_width,
-                      rData.m_height );
-
+    bool res = pBmp->drawBitmap( *pParentBmp, rData.m_x, rData.m_y, 0, 0,
+                                 rData.m_width, rData.m_height );
+    if( !res )
+    {
+        // Invalid sub-bitmap
+        delete pBmp;
+        msg_Warn( getIntf(), "SubBitmap %s ignored", rData.m_id.c_str() );
+        return;
+    }
     m_pTheme->m_bitmaps[rData.m_id] = GenericBitmapPtr( pBmp );
 }
 
@@ -178,7 +184,7 @@ void Builder::addBitmapFont( const BuilderData::BitmapFont &rData )
         new FileBitmap( getIntf(), m_pImageHandler, rData.m_file, 0 );
     if( !pBmp->getData() )
     {
-        // invalid bitmap
+        // Invalid bitmap
         delete pBmp;
         return;
     }

modules/gui/skins2/src/generic_bitmap.cpp

@@ -39,14 +39,26 @@ BitmapImpl::~BitmapImpl()
 }
 
 
-void BitmapImpl::drawBitmap( const GenericBitmap &rSource, int xSrc, int ySrc,
+bool BitmapImpl::drawBitmap( const GenericBitmap &rSource, int xSrc, int ySrc,
                              int xDest, int yDest, int width, int height )
 {
     int srcWidth = rSource.getWidth();
     uint32_t *pSrc = (uint32_t*)rSource.getData() + ySrc * srcWidth + xSrc;
     if( !pSrc )
     {
-        return;
+        return false;
+    }
+    if( xSrc < 0 || xSrc + width > srcWidth ||
+        ySrc < 0 || ySrc + height > rSource.getHeight() )
+    {
+        msg_Warn( getIntf(), "drawBitmap: source rect too small, ignoring" );
+        return false;
+    }
+    if( xDest < 0 || xDest + width > m_width ||
+        yDest < 0 || yDest + height > m_height )
+    {
+        msg_Warn( getIntf(), "drawBitmap: dest rect too small, ignoring" );
+        return false;
     }
 
     uint32_t *pDest = (uint32_t*)m_pData + yDest * m_width + xDest ;
@@ -56,5 +68,6 @@ void BitmapImpl::drawBitmap( const GenericBitmap &rSource, int xSrc, int ySrc,
         pSrc += srcWidth;
         pDest += m_width;
     }
+    return true;
 }
 

modules/gui/skins2/src/generic_bitmap.hpp

@@ -69,7 +69,7 @@ class BitmapImpl: public GenericBitmap
         virtual uint8_t *getData() const { return m_pData; }
 
         // Copy a region of another bitmap on this bitmap
-        void drawBitmap( const GenericBitmap &rSource, int xSrc, int ySrc,
+        bool drawBitmap( const GenericBitmap &rSource, int xSrc, int ySrc,
                          int xDest, int yDest, int width, int height );
 
     private: