From 4cedfe34c481c7e7e001840258ac2f939c8f52a7 Mon Sep 17 00:00:00 2001
From: espie <espie@openbsd.org>
Date: Tue, 24 Aug 2004 15:46:55 +0000
Subject: [PATCH] fixes for rle overload. okay naddy@

---
 .../patch-src_kernel_qasyncimageio_cpp        | 20 +++++++++
 x11/qt3/patches/patch-src_kernel_qimage_cpp   | 43 +++++++++++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 x11/qt3/patches/patch-src_kernel_qasyncimageio_cpp
 create mode 100644 x11/qt3/patches/patch-src_kernel_qimage_cpp

diff --git a/x11/qt3/patches/patch-src_kernel_qasyncimageio_cpp b/x11/qt3/patches/patch-src_kernel_qasyncimageio_cpp
new file mode 100644
index 00000000000..53e0bb5db21
--- /dev/null
+++ b/x11/qt3/patches/patch-src_kernel_qasyncimageio_cpp
@@ -0,0 +1,20 @@
+$OpenBSD: patch-src_kernel_qasyncimageio_cpp,v 1.1 2004/08/24 15:46:55 espie Exp $
+--- src/kernel/qasyncimageio.cpp.orig	Mon Apr 19 11:36:02 2004
++++ src/kernel/qasyncimageio.cpp	Tue Aug 24 10:58:24 2004
+@@ -992,6 +992,7 @@ int QGIFFormat::decode(QImage& img, QIma
+ 		accum = 0;
+ 		bitcount = 0;
+ 		sp = stack;
++                firstcode = oldcode = 0;
+ 		needfirst = FALSE;
+ 		out_of_bounds = FALSE;
+ 	    }
+@@ -1106,7 +1107,7 @@ int QGIFFormat::decode(QImage& img, QIma
+ 			oldcode=incode;
+ 			while (sp>stack) {
+ 			    --sp;
+-			    if (!out_of_bounds && *sp!=trans_index)
++			    if (!out_of_bounds && line && *sp!=trans_index)
+ 				line[y][x] = color(*sp);
+ 			    x++;
+ 			    if (x>=swidth) out_of_bounds = TRUE;
diff --git a/x11/qt3/patches/patch-src_kernel_qimage_cpp b/x11/qt3/patches/patch-src_kernel_qimage_cpp
new file mode 100644
index 00000000000..04aa67f53d7
--- /dev/null
+++ b/x11/qt3/patches/patch-src_kernel_qimage_cpp
@@ -0,0 +1,43 @@
+$OpenBSD: patch-src_kernel_qimage_cpp,v 1.1 2004/08/24 15:46:55 espie Exp $
+--- src/kernel/qimage.cpp.orig	Mon Apr 19 11:36:05 2004
++++ src/kernel/qimage.cpp	Tue Aug 24 10:58:24 2004
+@@ -4818,6 +4818,7 @@ bool read_dib( QDataStream& s, int offse
+ 	if ( comp == BMP_RLE8 ) {		// run length compression
+ 	    int x=0, y=0, b;
+ 	    register uchar *p = line[h-1];
++	    const uchar *endp = line[h-1]+w;
+ 	    while ( y < h ) {
+ 		if ( (b=d->getch()) == EOF )
+ 		    break;
+@@ -4835,9 +4836,20 @@ bool read_dib( QDataStream& s, int offse
+ 			case 2:			// delta (jump)
+ 			    x += d->getch();
+ 			    y += d->getch();
++
++			    // Protection
++			    if ( (uint)x >= (uint)w )
++				x = w-1;
++			    if ( (uint)y >= (uint)h )
++				y = h-1;
++
+ 			    p = line[h-y-1] + x;
+ 			    break;
+ 			default:		// absolute mode
++			    // Protection
++			    if ( p + b > endp )
++				b = endp-p;
++
+ 			    if ( d->readBlock( (char *)p, b ) != b )
+ 				return FALSE;
+ 			    if ( (b & 1) == 1 )
+@@ -4846,6 +4858,10 @@ bool read_dib( QDataStream& s, int offse
+ 			    p += b;
+ 		    }
+ 		} else {			// encoded mode
++		    // Protection
++		    if ( p + b > endp )
++			b = endp-p;
++
+ 		    memset( p, d->getch(), b ); // repeat pixel
+ 		    x += b;
+ 		    p += b;