andreacavalli/xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Bug #3822: out of bound reads in fbbltone and fbblt (Mark Kettenis, Thierry

Browse Source 
Deval).
This commit is contained in:
Matthieu Herrb 2005-10-01 17:53:38 +00:00
parent 54b2a14f0f
commit e270e6394b
2 changed files with 23 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fb/fbblt.c
View File

@ -271,8 +271,11 @@ fbBlt (FbBits *srcLine,
if (startmask)
{
bits = FbScrLeft(bits1, leftShift);
if (FbScrLeft(startmask, rightShift))
{
bits1 = *src++;
bits |= FbScrRight(bits1, rightShift);
}
FbDoLeftMaskByteMergeRop (dst, bits, startbyte, startmask);
dst++;
}

23
fb/fbbltone.c
View File

@ -52,12 +52,12 @@
#define LoadBits {\
if (leftShift) { \
bitsRight = *src++; \
bitsRight = (src < srcEnd ? *src++ : 0); \
bits = (FbStipLeft (bitsLeft, leftShift) | \
FbStipRight(bitsRight, rightShift)); \
bitsLeft = bitsRight; \
} else \
bits = *src++; \
bits = (src < srcEnd ? *src++ : 0); \
}
#ifndef FBNOPIXADDR
@ -151,6 +151,7 @@ fbBltOne (FbStip *src,
FbBits bgxor)
{
const FbBits *fbBits;
FbBits *srcEnd;
int pixelsPerDst; /* dst pixels per FbBits */
int unitsPerSrc; /* src patterns per FbStip */
int leftShift, rightShift; /* align source with dest */
@ -182,6 +183,11 @@ fbBltOne (FbStip *src,
}
#endif
/*
* Do not read past the end of the buffer!
*/
srcEnd = src + height * srcStride;
/*
* Number of destination units in FbBits == number of stipple pixels
* used each time
@ -232,11 +238,11 @@ fbBltOne (FbStip *src,
/*
* Get pointer to stipple mask array for this depth
*/
fbBits = NULL; /* unused */
fbBits = 0; /* unused */
if (pixelsPerDst <= 8)
fbBits = fbStippleTable[pixelsPerDst];
#ifndef FBNOPIXADDR
fbLane = NULL;
fbLane = 0;
if (transparent && fgand == 0 && dstBpp >= 8)
fbLane = fbLaneTable[dstBpp];
#endif
@ -532,7 +538,7 @@ const FbBits fbStipple24Bits[3][1 << FbStip24Len] = {
stip = FbLeftStipBits(bits, len); \
} else { \
stip = FbLeftStipBits(bits, remain); \
bits = *src++; \
bits = (src < srcEnd ? *src++ : 0); \
__len = (len) - remain; \
stip = FbMergePartStip24Bits(stip, FbLeftStipBits(bits, __len), \
remain, __len); \
@ -583,7 +589,7 @@ fbBltOne24 (FbStip *srcLine,
FbBits bgand,
FbBits bgxor)
{
FbStip *src;
FbStip *src, *srcEnd;
FbBits leftMask, rightMask, mask;
int nlMiddle, nl;
FbStip stip, bits;
@ -593,6 +599,11 @@ fbBltOne24 (FbStip *srcLine,
int rot0, rot;
int nDst;
/*
* Do not read past the end of the buffer!
*/
srcEnd = srcLine + height * srcStride;
srcLine += srcX >> FB_STIP_SHIFT;
dst += dstX >> FB_SHIFT;
srcX &= FB_STIP_MASK;