From 6c4a8766ab1f9ca6acb9e00bdfb275ffcd226bc0 Mon Sep 17 00:00:00 2001
From: PilzAdam <pilzadam@minetest.net>
Date: Mon, 9 Dec 2013 22:39:24 +0100
Subject: Check if width, height or start index of a list[] is negative

---
 src/guiFormSpecMenu.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/guiFormSpecMenu.cpp b/src/guiFormSpecMenu.cpp
index 920a7f1f2..82def7411 100644
--- a/src/guiFormSpecMenu.cpp
+++ b/src/guiFormSpecMenu.cpp
@@ -421,6 +421,12 @@ void GUIFormSpecMenu::parseList(parserData* data,std::string element) {
 		s32 start_i = 0;
 		if(startindex != "")
 			start_i = stoi(startindex);
+
+		if (geom.X < 0 || geom.Y < 0 || start_i < 0) {
+			errorstream<< "Invalid list element: '" << element << "'"  << std::endl;
+			return;
+		}
+
 		if(data->bp_set != 2)
 			errorstream<<"WARNING: invalid use of list without a size[] element"<<std::endl;
 		m_inventorylists.push_back(ListDrawSpec(loc, listname, pos, geom, start_i));
-- 
cgit v1.2.3