Fixed memory access outside of the range for source bits in 24-bit bitmaps.

graphics/x11drv/dib.c

@@ -2250,29 +2250,28 @@ static void X11DRV_DIB_SetImageBits_32( int lines, const BYTE *srcbits,
 	    /* ==== 32 BGR dib to 24 (888) BGR bitmap ==== */
 	    /* we need to check that source mask matches destination */
             {
-                DWORD *srcpixel;
-		BYTE  *bptr;
+                BYTE  *bptr;
 
-		srcpixel = (DWORD *) srcbits + left;
+                ptr = (DWORD *) srcbits + left;
                 bptr = bmpImage->data;
 
                 for (h = lines - 1; h >= 0; h--) {
                     for (x = 0; x < dstwidth; x++) {
-			/* *srcpixel is a 32bit value */
-			/* bptr points to first of 3 bytes */
-                        *bptr++ = (*srcpixel >> 16) & 0xff;
-                        *bptr++ = (*srcpixel >>  8) & 0xff;
-                        *bptr++ = (*srcpixel      ) & 0xff;
-			srcpixel++;
+                         /* *ptr is a 32bit value */
+                         /* bptr points to first of 3 bytes */
+                        *bptr++ = (*ptr >> 16) & 0xff;
+                        *bptr++ = (*ptr >>  8) & 0xff;
+                        *bptr++ = (*ptr      ) & 0xff;
+                        ptr++;
                     }
+                    ptr = (DWORD *) (srcbits += linebytes) + left;
                 }
             }
 	    break;
 	
         case 15:
 	    /* ==== 32 BGR dib to 555 BGR bitmap ==== */
-	    if (bmpImage->red_mask == 0x7c00 && bmpImage->blue_mask == 0x001f)
-            {
+	    if (bmpImage->red_mask == 0x7c00 && bmpImage->blue_mask == 0x001f) {
                 LPWORD  dstpixel;
 
                 for (h = lines - 1; h >= 0; h--) {
@@ -2411,24 +2410,25 @@ static void X11DRV_DIB_GetImageBits_32( int lines, BYTE *dstbits,
 	    /* we need to check that source mask matches destination */
             {
                 DWORD *srcpixel;
-		BYTE  *bptr;
-		DWORD srcdata;
+                BYTE  *bptr;
+                DWORD srcdata;
 
-		srcpixel = (DWORD *) dstbits;
+                srcpixel = (DWORD *) dstbits;
                 bptr = bmpImage->data;
 
                 for (h = lines - 1; h >= 0; h--) {
                     for (x = 0; x < dstwidth; x++) {
-			/* *srcpixel is a 32bit value */
-			/* bptr points to first of 3 bytes */
-			srcdata = 0;
-			srcdata	= srcdata << 8 | *bptr++;
-			srcdata = srcdata << 8 | *bptr++;	
-			srcdata = srcdata << 8 | *bptr++;	
-
-			*srcpixel++ = srcdata;
+                        /* *srcpixel is a 32bit value */
+						/* bptr points to first of 3 bytes */
+                        srcdata = 0;
+						srcdata	= srcdata << 8 | *bptr++;
+						srcdata = srcdata << 8 | *bptr++;	
+                        srcdata = srcdata << 8 | *bptr++;	
+
+                        *srcpixel++ = srcdata;
                     }
-                }
+                    srcpixel = (DWORD *) (dstbits += linebytes);
+				}
             }
 	    break;