[Gnash-commit] gnash ChangeLog gui/gtk_glue_agg.cpp

[Bastiaan Jacques]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Bastiaan Jacques <bjacques>     08/06/17 17:32:04

Modified files:
        .              : ChangeLog 
        gui            : gtk_glue_agg.cpp 

Log message:
        Make sure we don't overflow the buffer.  Fixes bug #23620.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.6962&r2=1.6963
http://cvs.savannah.gnu.org/viewcvs/gnash/gui/gtk_glue_agg.cpp?cvsroot=gnash&r1=1.35&r2=1.36

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.6962
retrieving revision 1.6963
diff -u -b -r1.6962 -r1.6963
--- ChangeLog   17 Jun 2008 14:55:12 -0000      1.6962
+++ ChangeLog   17 Jun 2008 17:32:03 -0000      1.6963
@@ -1,3 +1,8 @@
+2008-06-17 Bastiaan Jacques <address@hidden>
+
+       * gui/gtk_glue_agg.cpp: Make sure we don't overflow the buffer.
+       Fixes bug #23620.
+
 2008-06-17  Rob Savoye  <address@hidden>
 
        * libamf/amf.cpp: Drop a few debug messages.

Index: gui/gtk_glue_agg.cpp
===================================================================
RCS file: /sources/gnash/gnash/gui/gtk_glue_agg.cpp,v
retrieving revision 1.35
retrieving revision 1.36
diff -u -b -r1.35 -r1.36
--- gui/gtk_glue_agg.cpp        15 Jun 2008 07:47:17 -0000      1.35
+++ gui/gtk_glue_agg.cpp        17 Jun 2008 17:32:04 -0000      1.36
@@ -528,17 +528,21 @@
   
   } else {
 #endif       
+       size_t copy_width = std::min(_width * (_bpp/8), maxx - minx + 1);
+       size_t copy_height = std::min(_height, maxy - miny + 1);
+       size_t stride = _width*((_bpp+7)/8);
+
        // Update only the invalidated rectangle
        gdk_draw_rgb_image (
                _drawing_area->window,
                _drawing_area->style->fg_gc[GTK_STATE_NORMAL],
                minx,
        miny,
-               maxx-minx+1,
-               maxy-miny+1,
+               copy_width,
+               copy_height,
                GDK_RGB_DITHER_NORMAL,
-               _offscreenbuf + miny*(_width*(_bpp/8)) + minx*(_bpp/8),
-               (int)((_width)*_bpp/8)
+               _offscreenbuf + miny*stride + minx*(_bpp/8),
+               stride
        );
        
 #ifdef ENABLE_MIT_SHM