elm - table - protect against invalid cell/row values (16bit overflow)

legacy/elementary/src/lib/elm_table.c

@@ -343,6 +343,45 @@ _pack(Eo *obj, void *_pd EINA_UNUSED, va_list *list)
    int rowspan = va_arg(*list, int);
    ELM_WIDGET_DATA_GET_OR_RETURN(obj, wd);
 
+   if (col < 0)
+     {
+        ERR("col < 0");
+        return;
+     }
+   if (colspan < 1)
+     {
+        ERR("colspan < 1");
+        return;
+     }
+   if ((0xffff - col) < colspan)
+     {
+        ERR("col + colspan > 0xffff");
+        return;
+     }
+   if ((col + colspan) >= 0x7ffff)
+     {
+        WRN("col + colspan getting rather large (>32767)");
+     }
+   if (row < 0)
+     {
+        ERR("row < 0");
+        return;
+     }
+   if (rowspan < 1)
+     {
+        ERR("rowspan < 1");
+        return;
+     }
+   if ((0xffff - row) < rowspan)
+     {
+        ERR("row + rowspan > 0xffff");
+        return;
+     }
+   if ((row + rowspan) >= 0x7ffff)
+     {
+        WRN("row + rowspan getting rather large (>32767)");
+     }
+   
    elm_widget_sub_object_add(obj, subobj);
    evas_object_table_pack(wd->resize_obj, subobj, col, row, colspan, rowspan);
 }

legacy/elementary/src/lib/elm_table_legacy.h

@@ -68,6 +68,12 @@ EAPI void      elm_table_padding_get(const Evas_Object *obj, Evas_Coord *horizon
  * a value of 0 for x and y, means the top left cell of the table, and a
  * value of 1 for w and h means @p subobj only takes that 1 cell.
  *
+ * Note that columns and rows only guarantee 16bit unsigned values at best.
+ * That means that col + colspan AND row + rowspan must fit inside 16bit
+ * unsigned values cleanly. You will be warned once values exceed 15bit
+ * storage, and attempting to use values not able to fit in 16bits will
+ * result in failure.
+ * 
  * @ingroup Table
  */
 EAPI void      elm_table_pack(Evas_Object *obj, Evas_Object *subobj, int col, int row, int colspan, int rowspan);