bug-gnustep
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

memory overrun in xgps_cursor_mask


From: Willem Rein Oudshoorn
Subject: memory overrun in xgps_cursor_mask
Date: 19 Nov 2001 21:15:08 +0100
User-agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.1

Setting a cursor whose width is a multiple 8 
and containing an alpha component makes the method
xgps_cursor_mask  crash.
The reason is that the the at the end of the inner
loop at an 8 boundary the pointer is incremented, 
but is immediate after that also incremented by
the outer loop.

The following patch fixes this.


--------------[ ChangeLog & Diff ]--------------------------------


2001-11-19  Willem Rein Oudshoorn  <woudshoo@xs4all.nl>

        * xgps-devel/Source/SharedX/XGContextWindow.m ([XGContext 
-GSAvailableDepthsForScreen:screen_num]): 
        removed unused local variable declaration.
        (xgps_cursor_mask): fixed memory overrun.





Index: XGContextWindow.m
===================================================================
RCS file: /cvsroot/gnustep/gnustep/core/xgps/Source/SharedX/XGContextWindow.m,v
retrieving revision 1.78
diff -c -r1.78 XGContextWindow.m
*** XGContextWindow.m   2001/10/17 03:59:52     1.78
--- XGContextWindow.m   2001/11/19 20:01:55
***************
*** 2002,2019 ****
        for (j = 0; j < h; j++)
        {
          k = 0;
!         for (i = 0; i < w; i++)
            {
!             data += 3;
              ialpha = (unsigned short)((char)*data++);
              if (ialpha > ALPHA_THRESHOLD)
                *cData |= (0x01 << k);
-             k++;
-             if (k > 7)
-               {
-                 cData++;
-                 k = 0;
-               }
            }
          cData++;
        }
--- 2002,2018 ----
        for (j = 0; j < h; j++)
        {
          k = 0;
!         for (i = 0; i < w; i++, k++)
            {
!               if (k > 7)
!               {
!                   cData++;
!                   k = 0;
!               }
!               data += 3;
              ialpha = (unsigned short)((char)*data++);
              if (ialpha > ALPHA_THRESHOLD)
                *cData |= (0x01 << k);
            }
          cData++;
        }
***************
*** 2277,2283 ****
  {  
    Display     *display;
    Screen      *screen;
-   int          bpp = 0;
    int          class = 0;
    int          index = 0;
    int          ndepths = 0;
--- 2276,2281 ----




reply via email to

[Prev in Thread] Current Thread [Next in Thread]