fixes for rle overload.

okay naddy@
This commit is contained in:
espie 2004-08-24 15:46:55 +00:00
parent 0c0f93c97d
commit 4cedfe34c4
2 changed files with 63 additions and 0 deletions

View File

@ -0,0 +1,20 @@
$OpenBSD: patch-src_kernel_qasyncimageio_cpp,v 1.1 2004/08/24 15:46:55 espie Exp $
--- src/kernel/qasyncimageio.cpp.orig Mon Apr 19 11:36:02 2004
+++ src/kernel/qasyncimageio.cpp Tue Aug 24 10:58:24 2004
@@ -992,6 +992,7 @@ int QGIFFormat::decode(QImage& img, QIma
accum = 0;
bitcount = 0;
sp = stack;
+ firstcode = oldcode = 0;
needfirst = FALSE;
out_of_bounds = FALSE;
}
@@ -1106,7 +1107,7 @@ int QGIFFormat::decode(QImage& img, QIma
oldcode=incode;
while (sp>stack) {
--sp;
- if (!out_of_bounds && *sp!=trans_index)
+ if (!out_of_bounds && line && *sp!=trans_index)
line[y][x] = color(*sp);
x++;
if (x>=swidth) out_of_bounds = TRUE;

View File

@ -0,0 +1,43 @@
$OpenBSD: patch-src_kernel_qimage_cpp,v 1.1 2004/08/24 15:46:55 espie Exp $
--- src/kernel/qimage.cpp.orig Mon Apr 19 11:36:05 2004
+++ src/kernel/qimage.cpp Tue Aug 24 10:58:24 2004
@@ -4818,6 +4818,7 @@ bool read_dib( QDataStream& s, int offse
if ( comp == BMP_RLE8 ) { // run length compression
int x=0, y=0, b;
register uchar *p = line[h-1];
+ const uchar *endp = line[h-1]+w;
while ( y < h ) {
if ( (b=d->getch()) == EOF )
break;
@@ -4835,9 +4836,20 @@ bool read_dib( QDataStream& s, int offse
case 2: // delta (jump)
x += d->getch();
y += d->getch();
+
+ // Protection
+ if ( (uint)x >= (uint)w )
+ x = w-1;
+ if ( (uint)y >= (uint)h )
+ y = h-1;
+
p = line[h-y-1] + x;
break;
default: // absolute mode
+ // Protection
+ if ( p + b > endp )
+ b = endp-p;
+
if ( d->readBlock( (char *)p, b ) != b )
return FALSE;
if ( (b & 1) == 1 )
@@ -4846,6 +4858,10 @@ bool read_dib( QDataStream& s, int offse
p += b;
}
} else { // encoded mode
+ // Protection
+ if ( p + b > endp )
+ b = endp-p;
+
memset( p, d->getch(), b ); // repeat pixel
x += b;
p += b;