More fixes from David Fifield:

First, fill a missing pixel in the glyph for 'U'.

Second, fix an off-by-one in the line output routine. This caused an
extra space character to be output at the end of every line. It might
have caused a buffer overflow if any glyph had used the entire possible
width of 132 pixels, but as it is the widest is only 124 pixels.

Third, output blank lines instead of lines full of spaces (the number of
spaces was equal to the width of the most recent non-blank line).

Finally, add bounds checks to protect against buffer overflows that could arise
in case the data table were ever modified to draw out of bounds (characters
wider or taller than 132 pixels, or a two-byte code where the second byte is
past the end of the table).

ok bcallah

1 files changed, 50 insertions, 44 deletions

diff --git a/games/banner/banner.c b/games/banner/banner.c
index 85daf40122b..09538a31615 100644
--- a/games/banner/banner.c
+++ b/games/banner/banner.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: banner.c,v 1.22 2018/10/16 19:56:55 tb Exp $	*/
+/*	$OpenBSD: banner.c,v 1.23 2018/10/16 20:06:42 tb Exp $	*/
 /*	$NetBSD: banner.c,v 1.4 1995/04/22 11:55:15 cgd Exp $	*/
 
 /*
@@ -44,7 +44,7 @@
 #define MAXMSG 1024
 #define DWIDTH 132
 #define NCHARS 128
-#define NBYTES 9087
+#define NBYTES 9085
 
 /* Pointers into data_table for each ASCII char */
 const int asc_ptr[NCHARS] = {
@@ -58,12 +58,12 @@ const int asc_ptr[NCHARS] = {
 /*    '8' */	2202,   2411,   2587,   2623,      0,   2671,      0,   2677,
 /*    '@' */	2818,   3032,   3232,   3361,   3517,   3618,   3685,   3739,
 /*    'H' */	3918,   3952,   3966,   4065,   4230,   4262,   4379,   4494,
-/*    'P' */	4654,   4734,   4942,   5130,   5338,   5388,   5515,   5648,
-/*    'X' */	5829,   6042,   6192,      0,      0,      0,      0,      0,
-/*    '`' */	  48,   6437,   6575,   6665,   6767,   6859,   7001,   7084,
-/*    'h' */	7306,   7377,   7423,   7507,   7611,   7623,   7717,   7788,
-/*    'p' */	7896,   7986,   8076,   8137,   8295,   8355,   8420,   8516,
-/*    'x' */	8642,   8797,   8924,      0,      0,      0,      0,      0,
+/*    'P' */	4654,   4734,   4942,   5130,   5338,   5388,   5513,   5646,
+/*    'X' */	5827,   6040,   6190,      0,      0,      0,      0,      0,
+/*    '`' */	  48,   6435,   6573,   6663,   6765,   6857,   6999,   7082,
+/*    'h' */	7304,   7375,   7421,   7505,   7609,   7621,   7715,   7786,
+/*    'p' */	7894,   7984,   8074,   8135,   8293,   8353,   8418,   8514,
+/*    'x' */	8640,   8795,   8922,      0,      0,      0,      0,      0,
 };
 
 /*
@@ -697,9 +697,9 @@ const char data_table[NBYTES] = {
 	 33,    7,  129,   34,    7,  129,   35,    8,  129,   36,
 	  9,  117,    4,  129,   38,    9,  117,    4,  129,   40,
 	 10,  117,    4,  129,   42,   12,  117,    4,  129,   44,
-	 77,  129,   46,   75,  129,   50,   71,  129,   56,   43,
-	100,   21,  129,  117,    4,  132,  193,
-/* 5515 'V' */
+	 77,  129,   46,   75,  129,   50,   71,  129,   56,   65,
+	129,  117,    4,  132,  193,
+/* 5513 'V' */
 	117,    4,  132,  115,    6,  129,  110,   11,  129,  105,
 	 16,  129,  101,   20,  129,   96,   25,  129,   92,   29,
 	129,   87,   34,  129,   83,   38,  129,   78,   43,  129,
@@ -714,7 +714,7 @@ const char data_table[NBYTES] = {
 	  4,  129,   95,   16,  117,    4,  129,  100,   21,  129,
 	105,   16,  129,  110,   11,  129,  114,    7,  129,  117,
 	  4,  132,  193,
-/* 5648 'W' */
+/* 5646 'W' */
 	117,    4,  132,  115,    6,  129,  110,   11,  129,  105,
 	 16,  129,  101,   20,  129,   96,   25,  129,   92,   29,
 	129,   87,   34,  129,   83,   38,  129,   78,   43,  129,
@@ -734,7 +734,7 @@ const char data_table[NBYTES] = {
 	 95,   16,  117,    4,  129,  100,   21,  129,  105,   16,
 	129,  110,   11,  129,  114,    7,  129,  117,    4,  132,
 	193,
-/* 5829 'X' */
+/* 5827 'X' */
 	 30,    4,  117,    4,  132,   30,    4,  115,    6,  129,
 	 30,    4,  112,    9,  129,   30,    6,  109,   12,  129,
 	 30,    9,  106,   15,  129,   30,   11,  103,   18,  129,
@@ -757,7 +757,7 @@ const char data_table[NBYTES] = {
 	  8,  129,   30,   12,  116,    5,  129,   30,    9,  117,
 	  4,  129,   30,    6,  117,    4,  129,   30,    4,  117,
 	  4,  132,  193,
-/* 6042 'Y' */
+/* 6040 'Y' */
 	117,    4,  132,  114,    7,  129,  111,   10,  129,  108,
 	 13,  129,  105,   16,  129,  102,   19,  129,  100,   21,
 	129,   96,   25,  129,   93,   28,  129,   90,   31,  129,
@@ -773,7 +773,7 @@ const char data_table[NBYTES] = {
 	 11,  117,    4,  129,   97,   12,  117,    4,  129,  101,
 	 12,  117,    4,  129,  104,   17,  129,  108,   13,  129,
 	111,   10,  129,  115,    6,  129,  117,    4,  134,  193,
-/* 6192 'Z' */
+/* 6190 'Z' */
 	 30,    1,  103,   18,  129,   30,    4,  103,   18,  129,
 	 30,    7,  103,   18,  129,   30,    9,  103,   18,  129,
 	 30,   12,  110,   11,  129,   30,   15,  113,    8,  129,
@@ -799,7 +799,7 @@ const char data_table[NBYTES] = {
 	 11,  109,   12,  129,   30,   18,  112,    9,  129,   30,
 	 18,  115,    6,  129,   30,   18,  117,    4,  129,   30,
 	 18,  120,    1,  129,  193,
-/* 6437 'a' */
+/* 6435 'a' */
 	 42,    8,  129,   38,   16,  129,   36,   20,  129,   34,
 	 24,   71,    5,  129,   33,   26,   69,   10,  129,   32,
 	 28,   68,   13,  129,   31,   30,   68,   14,  129,   31,
@@ -814,7 +814,7 @@ const char data_table[NBYTES] = {
 	 31,   49,  129,   30,   49,  129,   30,   47,  129,   30,
 	 45,  129,   30,   41,  129,   30,    6,  129,   30,    4,
 	129,   30,    3,  129,   30,    2,  129,  193,
-/* 6575 'b' */
+/* 6573 'b' */
 	 30,    4,  117,    4,  130,   30,   91,  136,   37,    5,
 	 72,    5,  129,   35,    5,   74,    5,  129,   33,    5,
 	 76,    5,  129,   32,    5,   77,    5,  129,   31,    5,
@@ -824,7 +824,7 @@ const char data_table[NBYTES] = {
 	 72,   11,  129,   32,   15,   67,   15,  129,   33,   48,
 	129,   34,   46,  129,   35,   44,  129,   37,   40,  129,
 	 39,   36,  129,   42,   30,  129,   46,   22,  129,  193,
-/* 6665 'c' */
+/* 6663 'c' */
 	 48,   18,  129,   43,   28,  129,   41,   32,  129,   39,
 	 36,  129,   37,   40,  129,   35,   44,  129,   34,   46,
 	129,   33,   13,   68,   13,  129,   32,    9,   73,    9,
@@ -836,7 +836,7 @@ const char data_table[NBYTES] = {
 	129,   34,    4,   72,    8,  129,   35,    5,   72,    7,
 	129,   37,    5,   73,    4,  129,   39,    4,   74,    1,
 	129,  194,
-/* 6767 'd' */
+/* 6765 'd' */
 	 46,   22,  129,   42,   30,  129,   39,   36,  129,   37,
 	 40,  129,   35,   44,  129,   34,   46,  129,   33,   48,
 	129,   32,   15,   67,   15,  129,   31,   11,   72,   11,
@@ -847,7 +847,7 @@ const char data_table[NBYTES] = {
 	129,   35,    5,   74,    5,  117,    4,  129,   37,    5,
 	 72,    5,  117,    4,  129,   30,   91,  136,   30,    4,
 	130,  193,
-/* 6859 'e' */
+/* 6857 'e' */
 	 48,   18,  129,   43,   28,  129,   41,   32,  129,   39,
 	 36,  129,   37,   40,  129,   35,   44,  129,   34,   46,
 	129,   33,   13,   55,    4,   68,   13,  129,   32,    9,
@@ -863,7 +863,7 @@ const char data_table[NBYTES] = {
 	 24,  129,   37,    5,   55,   22,  129,   39,    4,   55,
 	 20,  129,   55,   18,  129,   55,   16,  129,   55,   11,
 	129,  193,
-/* 7001 'f' */
+/* 6999 'f' */
 	 80,    4,  129,   30,    4,   80,    4,  130,   30,   78,
 	129,   30,   82,  129,   30,   85,  129,   30,   87,  129,
 	 30,   88,  129,   30,   89,  129,   30,   90,  130,   30,
@@ -873,7 +873,7 @@ const char data_table[NBYTES] = {
 	 19,  129,   80,    4,  101,   19,  129,  101,   19,  129,
 	101,   18,  129,  102,   16,  129,  103,   12,  129,  105,
 	  6,  129,  193,
-/* 7084 'g' */
+/* 7082 'g' */
 	 12,   10,   59,   11,  129,    9,   16,   55,   19,  129,
 	  7,   20,   53,   23,  129,    6,    7,   23,    5,   32,
 	  6,   51,   27,  129,    4,    7,   25,   16,   50,   29,
@@ -897,7 +897,7 @@ const char data_table[NBYTES] = {
 	 55,   19,   80,   12,  129,   12,   12,   59,   11,   81,
 	 11,  129,   82,   10,  129,   84,    7,  129,   86,    4,
 	129,  193,
-/* 7306 'h' */
+/* 7304 'h' */
 	 30,    4,  117,    4,  130,   30,   91,  136,   30,    4,
 	 72,    5,  129,   30,    4,   74,    5,  129,   75,    5,
 	129,   76,    5,  129,   76,    6,  129,   77,    6,  130,
@@ -906,13 +906,13 @@ const char data_table[NBYTES] = {
 	 53,  130,   30,   52,  129,   30,   51,  129,   30,   49,
 	129,   30,   46,  129,   30,   42,  129,   30,    4,  130,
 	193,
-/* 7377 'i' */
+/* 7375 'i' */
 	 30,    4,   80,    4,  129,   30,    4,   80,    4,  100,
 	  6,  129,   30,   54,   98,   10,  129,   30,   54,   97,
 	 12,  129,   30,   54,   96,   14,  131,   30,   54,   97,
 	 12,  129,   30,   54,   98,   10,  129,   30,   54,  100,
 	  6,  129,   30,    4,  130,  193,
-/* 7423 'j' */
+/* 7421 'j' */
 	  7,    6,  129,    4,   11,  129,    3,   13,  129,    2,
 	 14,  129,    1,   15,  130,    1,    3,    6,    9,  129,
 	  1,    3,    7,    6,  129,    1,    3,  130,    1,    4,
@@ -922,7 +922,7 @@ const char data_table[NBYTES] = {
 	 96,   14,  129,    7,   77,   96,   14,  129,   10,   74,
 	 97,   12,  129,   14,   70,   98,   10,  129,   19,   65,
 	100,    6,  129,  193,
-/* 7507 'k' */
+/* 7505 'k' */
 	 30,    4,  117,    4,  130,   30,   91,  136,   30,    4,
 	 57,    9,  129,   30,    4,   55,   12,  129,   52,   17,
 	129,   50,   20,  129,   48,   24,  129,   46,   27,  129,
@@ -934,10 +934,10 @@ const char data_table[NBYTES] = {
 	 80,    4,  129,   30,   14,   80,    4,  129,   30,   12,
 	129,   30,   10,  129,   30,    7,  129,   30,    5,  129,
 	 30,    4,  130,  193,
-/* 7611 'l' */
+/* 7609 'l' */
 	 30,    4,  117,    4,  130,   30,   91,  136,   30,    4,
 	130,  193,
-/* 7623 'm' */
+/* 7621 'm' */
 	 30,    4,   80,    4,  130,   30,   54,  136,   30,    4,
 	 72,    5,  129,   30,    4,   74,    5,  129,   75,    5,
 	129,   76,    5,  129,   30,    4,   75,    7,  129,   30,
@@ -948,7 +948,7 @@ const char data_table[NBYTES] = {
 	 30,    4,   74,    9,  129,   30,   54,  132,   30,   53,
 	129,   30,   52,  129,   30,   51,  129,   30,   48,  129,
 	 30,    4,  130,  193,
-/* 7717 'n' */
+/* 7715 'n' */
 	 30,    4,   80,    4,  130,   30,   54,  136,   30,    4,
 	 72,    5,  129,   30,    4,   74,    5,  129,   75,    5,
 	129,   76,    5,  129,   76,    6,  129,   77,    6,  130,
@@ -957,7 +957,7 @@ const char data_table[NBYTES] = {
 	 53,  130,   30,   52,  129,   30,   51,  129,   30,   49,
 	129,   30,   46,  129,   30,   42,  129,   30,    4,  130,
 	193,
-/* 7788 'o' */
+/* 7786 'o' */
 	 48,   18,  129,   43,   28,  129,   41,   32,  129,   39,
 	 36,  129,   37,   40,  129,   35,   44,  129,   34,   46,
 	129,   33,   13,   68,   13,  129,   32,    9,   73,    9,
@@ -969,7 +969,7 @@ const char data_table[NBYTES] = {
 	129,   33,   13,   68,   13,  129,   34,   46,  129,   35,
 	 44,  129,   37,   40,  129,   39,   36,  129,   41,   32,
 	129,   43,   28,  129,   48,   18,  129,  193,
-/* 7896 'p' */
+/* 7894 'p' */
 	  1,    3,   80,    4,  130,    1,   83,  137,   37,    5,
 	 72,    5,  129,   35,    5,   74,    5,  129,   33,    5,
 	 76,    5,  129,   32,    5,   77,    5,  129,   31,    5,
@@ -979,7 +979,7 @@ const char data_table[NBYTES] = {
 	 72,   11,  129,   32,   15,   67,   15,  129,   33,   48,
 	129,   34,   46,  129,   35,   44,  129,   37,   40,  129,
 	 39,   36,  129,   42,   30,  129,   46,   22,  129,  193,
-/* 7986 'q' */
+/* 7984 'q' */
 	 46,   22,  129,   42,   30,  129,   39,   36,  129,   37,
 	 40,  129,   35,   44,  129,   34,   46,  129,   33,   48,
 	129,   32,   15,   67,   15,  129,   31,   11,   72,   11,
@@ -989,7 +989,7 @@ const char data_table[NBYTES] = {
 	129,   32,    5,   77,    5,  129,   33,    5,   76,    5,
 	129,   35,    5,   74,    5,  129,   37,    5,   72,    5,
 	129,    1,   83,  136,    1,    3,   80,    4,  130,  193,
-/* 8076 'r' */
+/* 8074 'r' */
 	 30,    4,   80,    4,  130,   30,   54,  136,   30,    4,
 	 68,    6,  129,   30,    4,   70,    6,  129,   71,    7,
 	129,   72,    7,  129,   73,    7,  129,   74,    7,  129,
@@ -997,7 +997,7 @@ const char data_table[NBYTES] = {
 	 17,  129,   66,   18,  129,   65,   19,  130,   65,   18,
 	130,   66,   16,  129,   67,   13,  129,   69,    8,  129,
 	193,
-/* 8137 's' */
+/* 8135 's' */
 	 30,   13,   64,    8,  129,   30,   13,   61,   14,  129,
 	 30,   13,   59,   18,  129,   30,   13,   57,   22,  129,
 	 33,    8,   56,   24,  129,   32,    7,   55,   26,  129,
@@ -1014,14 +1014,14 @@ const char data_table[NBYTES] = {
 	 71,   13,  129,   33,   27,   71,   13,  129,   34,   26,
 	 71,   13,  129,   35,   24,   71,   13,  129,   37,   20,
 	129,   39,   16,  129,   43,    9,  129,  193,
-/* 8295 't' */
+/* 8293 't' */
 	 80,    4,  131,   41,   56,  129,   37,   60,  129,   35,
 	 62,  129,   33,   64,  129,   32,   65,  129,   31,   66,
 	129,   30,   67,  130,   30,   11,   80,    4,  129,   30,
 	  9,   80,    4,  129,   30,    8,   80,    4,  129,   31,
 	  7,   80,    4,  129,   31,    6,  129,   32,    5,  129,
 	 33,    5,  129,   35,    4,  129,   38,    3,  129,  193,
-/* 8355 'u' */
+/* 8353 'u' */
 	 80,    4,  130,   42,   42,  129,   38,   46,  129,   35,
 	 49,  129,   33,   51,  129,   32,   52,  129,   31,   53,
 	130,   30,   54,  129,   30,   12,  129,   30,    9,  129,
@@ -1029,7 +1029,7 @@ const char data_table[NBYTES] = {
 	  6,  129,   33,    5,  129,   34,    5,  129,   35,    5,
 	 80,    4,  129,   37,    5,   80,    4,  129,   30,   54,
 	136,   30,    4,  130,  193,
-/* 8420 'v' */
+/* 8418 'v' */
 	 80,    4,  130,   77,    7,  129,   74,   10,  129,   70,
 	 14,  129,   66,   18,  129,   62,   22,  129,   59,   25,
 	129,   55,   29,  129,   51,   33,  129,   47,   37,  129,
@@ -1040,7 +1040,7 @@ const char data_table[NBYTES] = {
 	 59,   13,   80,    4,  129,   63,   13,   80,    4,  129,
 	 67,   17,  129,   71,   13,  129,   74,   10,  129,   78,
 	  6,  129,   80,    4,  131,  193,
-/* 8516 'w' */
+/* 8514 'w' */
 	 80,    4,  130,   77,    7,  129,   74,   10,  129,   70,
 	 14,  129,   66,   18,  129,   62,   22,  129,   59,   25,
 	129,   55,   29,  129,   51,   33,  129,   47,   37,  129,
@@ -1054,7 +1054,7 @@ const char data_table[NBYTES] = {
 	 59,   13,   80,    4,  129,   63,   13,   80,    4,  129,
 	 67,   17,  129,   71,   13,  129,   74,   10,  129,   78,
 	  6,  129,   80,    4,  131,  193,
-/* 8642 'x' */
+/* 8640 'x' */
 	 30,    4,   80,    4,  130,   30,    4,   79,    5,  129,
 	 30,    5,   77,    7,  129,   30,    6,   74,   10,  129,
 	 30,    8,   72,   12,  129,   30,   11,   69,   15,  129,
@@ -1071,7 +1071,7 @@ const char data_table[NBYTES] = {
 	 12,   75,    9,  129,   30,   10,   77,    7,  129,   30,
 	  7,   79,    5,  129,   30,    5,   80,    4,  129,   30,
 	  4,   80,    4,  130,  193,
-/* 8797 'y' */
+/* 8795 'y' */
 	  4,    5,   80,    4,  129,    2,    9,   80,    4,  129,
 	  1,   11,   77,    7,  129,    1,   12,   74,   10,  129,
 	  1,   12,   70,   14,  129,    1,   12,   66,   18,  129,
@@ -1085,7 +1085,7 @@ const char data_table[NBYTES] = {
 	129,   59,   13,   80,    4,  129,   63,   13,   80,    4,
 	129,   67,   17,  129,   71,   13,  129,   74,   10,  129,
 	 78,    6,  129,   80,    4,  131,  193,
-/* 8924 'z' */
+/* 8922 'z' */
 	 30,    1,   71,   13,  129,   30,    3,   71,   13,  129,
 	 30,    6,   71,   13,  129,   30,    9,   75,    9,  129,
 	 30,   11,   77,    7,  129,   30,   14,   79,    5,  129,
@@ -1224,8 +1224,8 @@ main(int argc, char *argv[])
 				if (x>192) term++;
 				x = x & 63;
 				while (x--) {
-					if (print[linen++]) {
-						for (j=0; j <= max; j++)
+					if (print[(unsigned int) linen++ % DWIDTH]) {
+						for (j=0; j < max && j < DWIDTH; j++)
 							if (print[j])
 								putchar(line[j]);
 						putchar('\n');
@@ -1233,8 +1233,13 @@ main(int argc, char *argv[])
 				}
 				for (j = 0; j < DWIDTH; j++) line[j] = ' ';
 				pc++;
+				max = 0;
 			}
 			else {
+				if (pc+1 < 0 || pc+1 >= NBYTES) {
+					printf("bad pc: %d\n",pc+1);
+					return 1;
+				}
 				y = data_table[pc+1];
 				/* compensate for narrow teminals */
 #ifdef notdef
@@ -1242,7 +1247,8 @@ main(int argc, char *argv[])
 				y = (y*width + (DWIDTH/2)) / DWIDTH;
 #endif
 				max = x+y;
-				while (x < max) line[x++] = '#';
+				while (x < max && x < DWIDTH)
+					line[x++] = '#';
 				pc += 2;
 				if (trace)
 					printf("x=%d, y=%d, max=%d\n",x,y,max);