[Gnash-commit] gnash ChangeLog server/parser/shape_character_d...

[Sandro Santilli]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Sandro Santilli <strk>  07/12/06 00:32:54

Modified files:
        .              : ChangeLog 
        server/parser  : shape_character_def.cpp 

Log message:
        don't consume an additional byte if both fill and line bits are zero. 

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.5093&r2=1.5094
http://cvs.savannah.gnu.org/viewcvs/gnash/server/parser/shape_character_def.cpp?cvsroot=gnash&r1=1.56&r2=1.57

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.5093
retrieving revision 1.5094
diff -u -b -r1.5093 -r1.5094
--- ChangeLog   5 Dec 2007 16:06:46 -0000       1.5093
+++ ChangeLog   6 Dec 2007 00:32:54 -0000       1.5094
@@ -1,3 +1,10 @@
+2007-12-06 Sandro Santilli <address@hidden>
+
+       * server/parser/shape_character_def.cpp (read): don't
+         consume an additional byte if both fill and line bits
+         are zero. Fixes an out-of-bound access during Glyph
+         parsing of bgtest.swf (1a2bd0411b38db40e74916a3b413522c)
+
 2007-12-05 Sandro Santilli <address@hidden>
 
        * testsuite/server/StreamTest.cpp: don't assume

Index: server/parser/shape_character_def.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/parser/shape_character_def.cpp,v
retrieving revision 1.56
retrieving revision 1.57
diff -u -b -r1.56 -r1.57
--- server/parser/shape_character_def.cpp       5 Dec 2007 08:24:36 -0000       
1.56
+++ server/parser/shape_character_def.cpp       6 Dec 2007 00:32:54 -0000       
1.57
@@ -17,7 +17,7 @@
 // Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 //
 
-/* $Id: shape_character_def.cpp,v 1.56 2007/12/05 08:24:36 strk Exp $ */
+/* $Id: shape_character_def.cpp,v 1.57 2007/12/06 00:32:54 strk Exp $ */
 
 // Based on the public domain shape.cpp of Thatcher Ulrich <address@hidden> 
2003
 
@@ -225,6 +225,11 @@
     log_parse(_("  shape_character_def read: nfillbits = %d, nlinebits = %d"), 
num_fill_bits, num_line_bits);
         );
 
+    if ( !num_fill_bits && !num_line_bits )
+    {
+       return;
+    }
+
     // These are state variables that keep the
     // current position & style of the shape
     // outline, and vary as we read the edge data.