From 07999443c24414602cf046fefc84d1d17b5afd69 Mon Sep 17 00:00:00 2001
From: Ben Harris <bjh21@bjh21.me.uk>
Date: Thu, 12 Jan 2023 14:34:14 +0000
Subject: Limit size of puzzle in Tents to avoid integer overflow

---
 tents.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tents.c b/tents.c
index 89e5dd2..cd7da79 100644
--- a/tents.c
+++ b/tents.c
@@ -32,6 +32,7 @@
 #include <string.h>
 #include <assert.h>
 #include <ctype.h>
+#include <limits.h>
 #include <math.h>
 
 #include "puzzles.h"
@@ -408,6 +409,8 @@ static const char *validate_params(const game_params *params, bool full)
      */
     if (params->w < 4 || params->h < 4)
 	return "Width and height must both be at least four";
+    if (params->w > (INT_MAX - 1) / params->h)
+        return "Width times height must not be unreasonably large";
     return NULL;
 }
 
-- 
cgit v1.1