fixed-size arrays of size PL_MAXPOLY cause out-of-bound and posible crashes

giloo — Fri, 03 Jun 2022 13:32:05 -0000

xscl and yscl , used by difilt(), are of size PL_MAXPOLY whereas their contents can be of any size, (see line 534 of plcore) causing invalid memory access and code corruption.
This is most visible when drawing a filled area of a shape of size > PL_MAXPOLY on the postscript driver, that triggers difilt() due to its (IMHO too complicated) coordinate conversions.

Recent changes to 203: fixed-size arrays of size PL_MAXPOLY cause out-of-bound and posible crashes

fixed-size arrays of size PL_MAXPOLY cause out-of-bound and posible crashes