Skip to content

W
wine-winehq
Commit 626691c4 authored by Stephane Lussier's avatar Stephane Lussier Committed by Alexandre Julliard
Browse files
Options

Fixed memory access outside of the range for source bits in 24-bit bitmaps.

parent da157857
Hide whitespace changes
Inline Side-by-side
Showing with 23 additions and 23 deletions
graphics/x11drv/dib.c
View file @ 626691c4
...@@ -2250,29 +2250,28 @@ static void X11DRV_DIB_SetImageBits_32( int lines, const BYTE *srcbits, ...@@ -2250,29 +2250,28 @@ static void X11DRV_DIB_SetImageBits_32( int lines, const BYTE *srcbits,
/* ==== 32 BGR dib to 24 (888) BGR bitmap ==== */ /* ==== 32 BGR dib to 24 (888) BGR bitmap ==== */
/* we need to check that source mask matches destination */ /* we need to check that source mask matches destination */
{ {
DWORD *srcpixel; BYTE *bptr;
BYTE *bptr;
srcpixel = (DWORD *) srcbits + left; ptr = (DWORD *) srcbits + left;
bptr = bmpImage->data; bptr = bmpImage->data;
for (h = lines - 1; h >= 0; h--) { for (h = lines - 1; h >= 0; h--) {
for (x = 0; x < dstwidth; x++) { for (x = 0; x < dstwidth; x++) {
/* *srcpixel is a 32bit value */ /* *ptr is a 32bit value */
/* bptr points to first of 3 bytes */ /* bptr points to first of 3 bytes */
*bptr++ = (*srcpixel >> 16) & 0xff; *bptr++ = (*ptr >> 16) & 0xff;
*bptr++ = (*srcpixel >> 8) & 0xff; *bptr++ = (*ptr >> 8) & 0xff;
*bptr++ = (*srcpixel ) & 0xff; *bptr++ = (*ptr ) & 0xff;
srcpixel++; ptr++;
} }
ptr = (DWORD *) (srcbits += linebytes) + left;
} }
} }
break; break;
case 15: case 15:
/* ==== 32 BGR dib to 555 BGR bitmap ==== */ /* ==== 32 BGR dib to 555 BGR bitmap ==== */
if (bmpImage->red_mask == 0x7c00 && bmpImage->blue_mask == 0x001f) if (bmpImage->red_mask == 0x7c00 && bmpImage->blue_mask == 0x001f) {
{
LPWORD dstpixel; LPWORD dstpixel;
for (h = lines - 1; h >= 0; h--) { for (h = lines - 1; h >= 0; h--) {
...@@ -2411,24 +2410,25 @@ static void X11DRV_DIB_GetImageBits_32( int lines, BYTE *dstbits, ...@@ -2411,24 +2410,25 @@ static void X11DRV_DIB_GetImageBits_32( int lines, BYTE *dstbits,
/* we need to check that source mask matches destination */ /* we need to check that source mask matches destination */
{ {
DWORD *srcpixel; DWORD *srcpixel;
BYTE *bptr; BYTE *bptr;
DWORD srcdata; DWORD srcdata;
srcpixel = (DWORD *) dstbits; srcpixel = (DWORD *) dstbits;
bptr = bmpImage->data; bptr = bmpImage->data;
for (h = lines - 1; h >= 0; h--) { for (h = lines - 1; h >= 0; h--) {
for (x = 0; x < dstwidth; x++) { for (x = 0; x < dstwidth; x++) {
/* *srcpixel is a 32bit value */ /* *srcpixel is a 32bit value */
/* bptr points to first of 3 bytes */ /* bptr points to first of 3 bytes */
srcdata = 0; srcdata = 0;
srcdata = srcdata << 8 | *bptr++; srcdata = srcdata << 8 | *bptr++;
srcdata = srcdata << 8 | *bptr++; srcdata = srcdata << 8 | *bptr++;
srcdata = srcdata << 8 | *bptr++; srcdata = srcdata << 8 | *bptr++;
*srcpixel++ = srcdata; *srcpixel++ = srcdata;
} }
} srcpixel = (DWORD *) (dstbits += linebytes);
}
} }
break; break;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment