[Gnash-commit] gnash ChangeLog server/DynamicShape.cpp

[Sandro Santilli]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Sandro Santilli <strk>  08/01/25 17:38:17

Modified files:
        .              : ChangeLog 
        server         : DynamicShape.cpp 

Log message:
        Reset current line and fill styles on clear().
        Fixes memory corruption in 
http://www.gazbming.com/embed.php?id=sketchpad

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.5492&r2=1.5493
http://cvs.savannah.gnu.org/viewcvs/gnash/server/DynamicShape.cpp?cvsroot=gnash&r1=1.16&r2=1.17

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.5492
retrieving revision 1.5493
diff -u -b -r1.5492 -r1.5493
--- ChangeLog   25 Jan 2008 12:17:30 -0000      1.5492
+++ ChangeLog   25 Jan 2008 17:38:16 -0000      1.5493
@@ -1,5 +1,9 @@
 2008-01-25 Sandro Santilli <address@hidden>
 
+       * server/DynamicShape.cpp (clear): reset _currfill and _currline
+         or they might point to released memory (line/fill styles were
+         cleared). Fixes illegal vector access in
+         http://www.gazbming.com/embed.php?id=sketchpad
        * server/swf/DefineFontAlignZonesTag.cpp: warn only
          once about not being implemented.
        * server/parser/shape_character_def.cpp (read): 

Index: server/DynamicShape.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/DynamicShape.cpp,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -b -r1.16 -r1.17
--- server/DynamicShape.cpp     21 Jan 2008 20:55:46 -0000      1.16
+++ server/DynamicShape.cpp     25 Jan 2008 17:38:17 -0000      1.17
@@ -17,7 +17,7 @@
 
 
 
-/* $Id: DynamicShape.cpp,v 1.16 2008/01/21 20:55:46 rsavoye Exp $ */
+/* $Id: DynamicShape.cpp,v 1.17 2008/01/25 17:38:17 strk Exp $ */
 
 #include "DynamicShape.h"
 
@@ -47,8 +47,9 @@
        m_line_styles.clear();
        m_bound.set_null();
        _currpath=0; // or would point to invalid memory
+       _currfill = _currline = 0; // or would point to cleared m_fill_style 
and m_line_styles respectively
 
-       // TODO: set _changed=true ? reset _currfill and _currline ?
+       // TODO: worth setting _changed=true ? 
 }
 
 void