Bug #3822: out of bound reads in fbbltone and fbblt (Mark Kettenis, Thierry
Deval).
This commit is contained in:
parent
54b2a14f0f
commit
e270e6394b
|
@ -271,8 +271,11 @@ fbBlt (FbBits *srcLine,
|
|||
if (startmask)
|
||||
{
|
||||
bits = FbScrLeft(bits1, leftShift);
|
||||
bits1 = *src++;
|
||||
bits |= FbScrRight(bits1, rightShift);
|
||||
if (FbScrLeft(startmask, rightShift))
|
||||
{
|
||||
bits1 = *src++;
|
||||
bits |= FbScrRight(bits1, rightShift);
|
||||
}
|
||||
FbDoLeftMaskByteMergeRop (dst, bits, startbyte, startmask);
|
||||
dst++;
|
||||
}
|
||||
|
|
|
@ -52,12 +52,12 @@
|
|||
|
||||
#define LoadBits {\
|
||||
if (leftShift) { \
|
||||
bitsRight = *src++; \
|
||||
bitsRight = (src < srcEnd ? *src++ : 0); \
|
||||
bits = (FbStipLeft (bitsLeft, leftShift) | \
|
||||
FbStipRight(bitsRight, rightShift)); \
|
||||
bitsLeft = bitsRight; \
|
||||
} else \
|
||||
bits = *src++; \
|
||||
bits = (src < srcEnd ? *src++ : 0); \
|
||||
}
|
||||
|
||||
#ifndef FBNOPIXADDR
|
||||
|
@ -151,6 +151,7 @@ fbBltOne (FbStip *src,
|
|||
FbBits bgxor)
|
||||
{
|
||||
const FbBits *fbBits;
|
||||
FbBits *srcEnd;
|
||||
int pixelsPerDst; /* dst pixels per FbBits */
|
||||
int unitsPerSrc; /* src patterns per FbStip */
|
||||
int leftShift, rightShift; /* align source with dest */
|
||||
|
@ -181,7 +182,12 @@ fbBltOne (FbStip *src,
|
|||
return;
|
||||
}
|
||||
#endif
|
||||
|
||||
|
||||
/*
|
||||
* Do not read past the end of the buffer!
|
||||
*/
|
||||
srcEnd = src + height * srcStride;
|
||||
|
||||
/*
|
||||
* Number of destination units in FbBits == number of stipple pixels
|
||||
* used each time
|
||||
|
@ -232,11 +238,11 @@ fbBltOne (FbStip *src,
|
|||
/*
|
||||
* Get pointer to stipple mask array for this depth
|
||||
*/
|
||||
fbBits = NULL; /* unused */
|
||||
fbBits = 0; /* unused */
|
||||
if (pixelsPerDst <= 8)
|
||||
fbBits = fbStippleTable[pixelsPerDst];
|
||||
#ifndef FBNOPIXADDR
|
||||
fbLane = NULL;
|
||||
fbLane = 0;
|
||||
if (transparent && fgand == 0 && dstBpp >= 8)
|
||||
fbLane = fbLaneTable[dstBpp];
|
||||
#endif
|
||||
|
@ -532,7 +538,7 @@ const FbBits fbStipple24Bits[3][1 << FbStip24Len] = {
|
|||
stip = FbLeftStipBits(bits, len); \
|
||||
} else { \
|
||||
stip = FbLeftStipBits(bits, remain); \
|
||||
bits = *src++; \
|
||||
bits = (src < srcEnd ? *src++ : 0); \
|
||||
__len = (len) - remain; \
|
||||
stip = FbMergePartStip24Bits(stip, FbLeftStipBits(bits, __len), \
|
||||
remain, __len); \
|
||||
|
@ -583,7 +589,7 @@ fbBltOne24 (FbStip *srcLine,
|
|||
FbBits bgand,
|
||||
FbBits bgxor)
|
||||
{
|
||||
FbStip *src;
|
||||
FbStip *src, *srcEnd;
|
||||
FbBits leftMask, rightMask, mask;
|
||||
int nlMiddle, nl;
|
||||
FbStip stip, bits;
|
||||
|
@ -593,6 +599,11 @@ fbBltOne24 (FbStip *srcLine,
|
|||
int rot0, rot;
|
||||
int nDst;
|
||||
|
||||
/*
|
||||
* Do not read past the end of the buffer!
|
||||
*/
|
||||
srcEnd = srcLine + height * srcStride;
|
||||
|
||||
srcLine += srcX >> FB_STIP_SHIFT;
|
||||
dst += dstX >> FB_SHIFT;
|
||||
srcX &= FB_STIP_MASK;
|
||||
|
|
Loading…
Reference in New Issue
Block a user