Re: memory overrun in xgps_cursor_mask

[Nicola Pero]

Thanks - applied

On 19 Nov 2001, Willem Rein Oudshoorn wrote:

> 
> Setting a cursor whose width is a multiple 8 
> and containing an alpha component makes the method
> xgps_cursor_mask  crash.
> The reason is that the the at the end of the inner
> loop at an 8 boundary the pointer is incremented, 
> but is immediate after that also incremented by
> the outer loop.
> 
> The following patch fixes this.
> 
> 
> --------------[ ChangeLog & Diff ]--------------------------------
> 
> 
> 2001-11-19  Willem Rein Oudshoorn  <woudshoo@xs4all.nl>
> 
>       * xgps-devel/Source/SharedX/XGContextWindow.m ([XGContext 
> -GSAvailableDepthsForScreen:screen_num]): 
>       removed unused local variable declaration.
>       (xgps_cursor_mask): fixed memory overrun.
> 
> 
> 
> 
> 
> Index: XGContextWindow.m
> ===================================================================
> RCS file: 
> /cvsroot/gnustep/gnustep/core/xgps/Source/SharedX/XGContextWindow.m,v
> retrieving revision 1.78
> diff -c -r1.78 XGContextWindow.m
> *** XGContextWindow.m 2001/10/17 03:59:52     1.78
> --- XGContextWindow.m 2001/11/19 20:01:55
> ***************
> *** 2002,2019 ****
>         for (j = 0; j < h; j++)
>       {
>         k = 0;
> !       for (i = 0; i < w; i++)
>           {
> !           data += 3;
>             ialpha = (unsigned short)((char)*data++);
>             if (ialpha > ALPHA_THRESHOLD)
>               *cData |= (0x01 << k);
> -           k++;
> -           if (k > 7)
> -             {
> -               cData++;
> -               k = 0;
> -             }
>           }
>         cData++;
>       }
> --- 2002,2018 ----
>         for (j = 0; j < h; j++)
>       {
>         k = 0;
> !       for (i = 0; i < w; i++, k++)
>           {
> !               if (k > 7)
> !             {
> !                   cData++;
> !                   k = 0;
> !             }
> !               data += 3;
>             ialpha = (unsigned short)((char)*data++);
>             if (ialpha > ALPHA_THRESHOLD)
>               *cData |= (0x01 << k);
>           }
>         cData++;
>       }
> ***************
> *** 2277,2283 ****
>   {  
>     Display   *display;
>     Screen    *screen;
> -   int                bpp = 0;
>     int                class = 0;
>     int                index = 0;
>     int                ndepths = 0;
> --- 2276,2281 ----
> 
> 
> _______________________________________________
> Bug-gnustep mailing list
> Bug-gnustep@gnu.org
> http://mail.gnu.org/mailman/listinfo/bug-gnustep
> 
>