Added checks to avoid writing past the end of the buffer in fbBltOne
(cherry picked from commit e5f54f122b
)
This commit is contained in:
parent
c8161d482a
commit
24c54f53ff
@ -57,6 +57,13 @@
|
||||
bits = (src < srcEnd ? READ(src++) : 0); \
|
||||
}
|
||||
|
||||
#define CHECK_BOUNDS(pointer, limit) \
|
||||
if (dst > dstEnd) { \
|
||||
ErrorF("WARNING: fbbltone tried to write over end of buffer (dst=%p dstEnd=%p)\n", \
|
||||
dst, dstEnd); \
|
||||
return; \
|
||||
}
|
||||
|
||||
#ifndef FBNOPIXADDR
|
||||
|
||||
#define LaneCases1(n,a) case n: (void)FbLaneCase(n,a); break
|
||||
@ -148,7 +155,7 @@ fbBltOne (FbStip *src,
|
||||
FbBits bgxor)
|
||||
{
|
||||
const FbBits *fbBits;
|
||||
FbBits *srcEnd;
|
||||
FbBits *srcEnd, *dstEnd;
|
||||
int pixelsPerDst; /* dst pixels per FbBits */
|
||||
int unitsPerSrc; /* src patterns per FbStip */
|
||||
int leftShift, rightShift; /* align source with dest */
|
||||
@ -181,9 +188,10 @@ fbBltOne (FbStip *src,
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Do not read past the end of the buffer!
|
||||
* Do not read or write past the end of the buffer!
|
||||
*/
|
||||
srcEnd = src + height * srcStride;
|
||||
dstEnd = dst + height * dstStride;
|
||||
|
||||
/*
|
||||
* Number of destination units in FbBits == number of stipple pixels
|
||||
@ -296,6 +304,7 @@ fbBltOne (FbStip *src,
|
||||
*/
|
||||
if (startmask)
|
||||
{
|
||||
CHECK_BOUNDS(dst, dstEnd);
|
||||
#if FB_UNIT > 32
|
||||
if (pixelsPerDst == 16)
|
||||
mask = FbStipple16Bits(FbLeftStipBits(bits,16));
|
||||
@ -336,6 +345,7 @@ fbBltOne (FbStip *src,
|
||||
else
|
||||
#endif
|
||||
mask = fbBits[FbLeftStipBits(bits,pixelsPerDst)];
|
||||
CHECK_BOUNDS(dst, dstEnd);
|
||||
WRITE(dst, FbOpaqueStipple (mask, fgxor, bgxor));
|
||||
dst++;
|
||||
bits = FbStipLeft(bits, pixelsPerDst);
|
||||
@ -346,6 +356,7 @@ fbBltOne (FbStip *src,
|
||||
#ifndef FBNOPIXADDR
|
||||
if (fbLane)
|
||||
{
|
||||
CHECK_BOUNDS(dst, dstEnd);
|
||||
while (bits && n)
|
||||
{
|
||||
switch (fbLane[FbLeftStipBits(bits,pixelsPerDst)]) {
|
||||
@ -366,6 +377,7 @@ fbBltOne (FbStip *src,
|
||||
if (left || !transparent)
|
||||
{
|
||||
mask = fbBits[left];
|
||||
CHECK_BOUNDS(dst, dstEnd);
|
||||
WRITE(dst, FbStippleRRop (READ(dst), mask,
|
||||
fgand, fgxor, bgand, bgxor));
|
||||
}
|
||||
@ -586,7 +598,7 @@ fbBltOne24 (FbStip *srcLine,
|
||||
FbBits bgand,
|
||||
FbBits bgxor)
|
||||
{
|
||||
FbStip *src, *srcEnd;
|
||||
FbStip *src, *srcEnd, *dstEnd;
|
||||
FbBits leftMask, rightMask, mask;
|
||||
int nlMiddle, nl;
|
||||
FbStip stip, bits;
|
||||
@ -597,9 +609,10 @@ fbBltOne24 (FbStip *srcLine,
|
||||
int nDst;
|
||||
|
||||
/*
|
||||
* Do not read past the end of the buffer!
|
||||
* Do not read or write past the end of the buffer!
|
||||
*/
|
||||
srcEnd = srcLine + height * srcStride;
|
||||
dstEnd = dst + height * dstStride;
|
||||
|
||||
srcLine += srcX >> FB_STIP_SHIFT;
|
||||
dst += dstX >> FB_SHIFT;
|
||||
@ -629,6 +642,7 @@ fbBltOne24 (FbStip *srcLine,
|
||||
if (leftMask)
|
||||
{
|
||||
mask = fbStipple24Bits[rot >> 3][stip];
|
||||
CHECK_BOUNDS(dst, dstEnd);
|
||||
WRITE(dst, (READ(dst) & ~leftMask) |
|
||||
(FbOpaqueStipple (mask,
|
||||
FbRot24(fgxor, rot),
|
||||
@ -641,6 +655,7 @@ fbBltOne24 (FbStip *srcLine,
|
||||
while (nl--)
|
||||
{
|
||||
mask = fbStipple24Bits[rot>>3][stip];
|
||||
CHECK_BOUNDS(dst, dstEnd);
|
||||
WRITE(dst, FbOpaqueStipple (mask,
|
||||
FbRot24(fgxor, rot),
|
||||
FbRot24(bgxor, rot)));
|
||||
@ -650,6 +665,7 @@ fbBltOne24 (FbStip *srcLine,
|
||||
if (rightMask)
|
||||
{
|
||||
mask = fbStipple24Bits[rot >> 3][stip];
|
||||
CHECK_BOUNDS(dst, dstEnd);
|
||||
WRITE(dst, (READ(dst) & ~rightMask) |
|
||||
(FbOpaqueStipple (mask,
|
||||
FbRot24(fgxor, rot),
|
||||
@ -674,6 +690,7 @@ fbBltOne24 (FbStip *srcLine,
|
||||
if (stip)
|
||||
{
|
||||
mask = fbStipple24Bits[rot >> 3][stip] & leftMask;
|
||||
CHECK_BOUNDS(dst, dstEnd);
|
||||
WRITE(dst, (READ(dst) & ~mask) | (FbRot24(fgxor, rot) & mask));
|
||||
}
|
||||
dst++;
|
||||
@ -685,6 +702,7 @@ fbBltOne24 (FbStip *srcLine,
|
||||
if (stip)
|
||||
{
|
||||
mask = fbStipple24Bits[rot>>3][stip];
|
||||
CHECK_BOUNDS(dst, dstEnd);
|
||||
WRITE(dst, (READ(dst) & ~mask) | (FbRot24(fgxor,rot) & mask));
|
||||
}
|
||||
dst++;
|
||||
@ -695,6 +713,7 @@ fbBltOne24 (FbStip *srcLine,
|
||||
if (stip)
|
||||
{
|
||||
mask = fbStipple24Bits[rot >> 3][stip] & rightMask;
|
||||
CHECK_BOUNDS(dst, dstEnd);
|
||||
WRITE(dst, (READ(dst) & ~mask) | (FbRot24(fgxor, rot) & mask));
|
||||
}
|
||||
}
|
||||
@ -712,6 +731,7 @@ fbBltOne24 (FbStip *srcLine,
|
||||
if (leftMask)
|
||||
{
|
||||
mask = fbStipple24Bits[rot >> 3][stip];
|
||||
CHECK_BOUNDS(dst, dstEnd);
|
||||
WRITE(dst, FbStippleRRopMask (READ(dst), mask,
|
||||
FbRot24(fgand, rot),
|
||||
FbRot24(fgxor, rot),
|
||||
@ -725,6 +745,7 @@ fbBltOne24 (FbStip *srcLine,
|
||||
while (nl--)
|
||||
{
|
||||
mask = fbStipple24Bits[rot >> 3][stip];
|
||||
CHECK_BOUNDS(dst, dstEnd);
|
||||
WRITE(dst, FbStippleRRop (READ(dst), mask,
|
||||
FbRot24(fgand, rot),
|
||||
FbRot24(fgxor, rot),
|
||||
@ -736,6 +757,7 @@ fbBltOne24 (FbStip *srcLine,
|
||||
if (rightMask)
|
||||
{
|
||||
mask = fbStipple24Bits[rot >> 3][stip];
|
||||
CHECK_BOUNDS(dst, dstEnd);
|
||||
WRITE(dst, FbStippleRRopMask (READ(dst), mask,
|
||||
FbRot24(fgand, rot),
|
||||
FbRot24(fgxor, rot),
|
||||
|
Loading…
Reference in New Issue
Block a user