Attachment 225869 Details for Bug 389386

[patch] xorg-server-1.4-vnc-crash.diff

xorg-server-1.4-vnc-crash.diff (text/plain), 1.22 KB, created by Stefan Dirsch on 2008-07-03 17:02:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stefan Dirsch

Created: 2008-07-03 17:02:55 UTC

Size: 1.22 KB

patch

obsolete

>diff -u -r -p xorg-server-1.4.0.90.old//hw/vnc/translate.c xorg-server-1.4.0.90/hw/vnc/translate.c
>--- xorg-server-1.4.0.90.old//hw/vnc/translate.c	2008-07-03 18:59:24.000000000 +0200
>+++ xorg-server-1.4.0.90/hw/vnc/translate.c	2008-07-03 18:59:44.000000000 +0200
>@@ -168,17 +168,17 @@ rfbTranslateNone(ScreenPtr pScreen, char
> {
>     VNCSCREENPTR(pScreen);
>     DrawablePtr pDraw = (DrawablePtr)WindowTable[pScreen->myNum];
>-    int truewidth = PixmapBytePad(width, in->bitsPerPixel) / 4;
>+    int truewidth = PixmapBytePad(width, in->bitsPerPixel);
> 
>-    if ((x + truewidth > pVNC->width) || truewidth != width) {
>-	unsigned char *buffer = malloc(truewidth * height * in->bitsPerPixel / 8);
>+    if ((x + width > pVNC->width) || truewidth != width * in->bitsPerPixel / 8) {
>+	unsigned char *buffer = malloc(truewidth * height);
> 	unsigned char *buf = buffer;
> 	
>-    	(*pScreen->GetImage)(pDraw, x, y, truewidth, height, ZPixmap, ~0, (char*)buf);
>+    	(*pScreen->GetImage)(pDraw, x, y, width, height, ZPixmap, ~0, (char*)buf);
> 	while (height--) {
> 	    memcpy(optr, buf, width * in->bitsPerPixel / 8);
> 	    optr += width * in->bitsPerPixel / 8;
>-	    buf += truewidth * in->bitsPerPixel / 8;
>+	    buf += truewidth;
> 	}
> 	free(buffer);
> 	return;

Actions: View | Diff

Attachments on bug 389386: 214455 | 214456 | 214457 | 225862 | 225869 | 227354