From 49963980e6ff7fa943743e0cb88132cb6f0fe2f5 Mon Sep 17 00:00:00 2001
From: QuanTech0 <1337h4x0rname@gmail.com>
Date: Sat, 9 May 2020 13:54:12 -0400
Subject: [PATCH] Constrain brushx and brushy values (#716)

---
 src/lua/LuaScriptInterface.cpp | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/lua/LuaScriptInterface.cpp b/src/lua/LuaScriptInterface.cpp
index 9851cc7ea..87baf3528 100644
--- a/src/lua/LuaScriptInterface.cpp
+++ b/src/lua/LuaScriptInterface.cpp
@@ -445,9 +445,21 @@ int LuaScriptInterface::tpt_newIndex(lua_State *l)
 			luaL_error(l, "Invalid tool identifier: %s", lua_tostring(l, 3));
 	}
 	else if (!key.compare("brushx"))
-		c->SetBrushSize(ui::Point(luaL_checkinteger(l, 3), m->GetBrush()->GetRadius().Y));
+	{
+		int brushx = luaL_checkinteger(l, 3);
+		if (brushx < 0 || brushx >= XRES)
+			luaL_error(l, "Invalid brush width");
+
+		c->SetBrushSize(ui::Point(brushx, m->GetBrush()->GetRadius().Y));
+	}
 	else if (!key.compare("brushy"))
-		c->SetBrushSize(ui::Point(m->GetBrush()->GetRadius().X, luaL_checkinteger(l, 3)));
+	{
+		int brushy = luaL_checkinteger(l, 3);
+		if (brushy < 0 || brushy >= YRES)
+			luaL_error(l, "Invalid brush height");
+
+		c->SetBrushSize(ui::Point(m->GetBrush()->GetRadius().X, brushy));
+	}
 	else if (!key.compare("brushID"))
 		m->SetBrushID(luaL_checkinteger(l, 3));
 	else if (!key.compare("decoSpace"))