Attachment 2878 Details for Bug 3822 – Patch that fixes the problem

[patch] Patch that fixes the problem

patch (text/plain), 2.05 KB, created by Mark Kettenis on 2005-08-15 13:11:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Kettenis

Created: 2005-08-15 13:11:58 UTC

Size: 2.05 KB

patch

obsolete

>Index: fbbltone.c
>===================================================================
>RCS file: /cvs/XF4/xc/programs/Xserver/fb/fbbltone.c,v
>retrieving revision 1.2
>diff -u -p -r1.2 fbbltone.c
>--- fbbltone.c	3 Nov 2004 00:07:51 -0000	1.2
>+++ fbbltone.c	15 Aug 2005 19:53:17 -0000
>@@ -48,12 +48,12 @@
> 
> #define LoadBits {\
>     if (leftShift) { \
>-	bitsRight = *src++; \
>+	bitsRight = (src < srcEnd ? *src++ : 0); \
> 	bits = (FbStipLeft (bitsLeft, leftShift) | \
> 		FbStipRight(bitsRight, rightShift)); \
> 	bitsLeft = bitsRight; \
>     } else \
>-	bits = *src++; \
>+	bits = (src < srcEnd ? *src++ : 0); \
> }
>     
> #ifndef FBNOPIXADDR
>@@ -147,6 +147,7 @@ fbBltOne (FbStip    *src,
> 	  FbBits    bgxor)
> {
>     const FbBits    *fbBits;
>+    FbBits	    *srcEnd;
>     int		    pixelsPerDst;		/* dst pixels per FbBits */
>     int		    unitsPerSrc;		/* src patterns per FbStip */
>     int		    leftShift, rightShift;	/* align source with dest */
>@@ -177,7 +178,12 @@ fbBltOne (FbStip    *src,
> 	return;
>     }
> #endif
>-    
>+
>+    /*
>+     * Do not read past the end of the buffer!
>+     */
>+    srcEnd = src + height * srcStride;
>+
>     /*
>      * Number of destination units in FbBits == number of stipple pixels
>      * used each time
>@@ -528,7 +534,7 @@ const FbBits	fbStipple24Bits[3][1 << FbS
> 	stip = FbLeftStipBits(bits, len); \
>     } else { \
> 	stip = FbLeftStipBits(bits, remain); \
>-	bits = *src++; \
>+	bits = (src < srcEnd ? *src++ : 0); \
> 	__len = (len) - remain; \
> 	stip = FbMergePartStip24Bits(stip, FbLeftStipBits(bits, __len), \
> 				     remain, __len); \
>@@ -579,7 +585,7 @@ fbBltOne24 (FbStip	*srcLine,
> 	    FbBits	bgand,
> 	    FbBits	bgxor)
> {
>-    FbStip	*src;
>+    FbStip	*src, *srcEnd;
>     FbBits	leftMask, rightMask, mask;
>     int		nlMiddle, nl;
>     FbStip	stip, bits;
>@@ -589,6 +595,11 @@ fbBltOne24 (FbStip	*srcLine,
>     int		rot0, rot;
>     int		nDst;
>     
>+    /*
>+     * Do not read past the end of the buffer!
>+     */
>+    srcEnd = srcLine + height * srcStride;
>+
>     srcLine += srcX >> FB_STIP_SHIFT;
>     dst += dstX >> FB_SHIFT;
>     srcX &= FB_STIP_MASK;

Actions: View | Splinter Review

Attachments on bug 3822: 2877 | 2878 | 3097 | 3098

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.