xx0 is set as maximum to buffer width so we need < not <= here

Fixes some crashes due to write out of bounds

BUGS: 158387, 158549

svn path=/branches/KDE/3.5/kdegraphics/kpdf/; revision=785716
remotes/origin/kpdf-3.5
Albert Astals Cid 18 years ago
parent bd90e9cc73
commit cf9a6deead
  1. 5
      xpdf/splash/SplashXPathScanner.cc

@ -397,7 +397,7 @@ void SplashXPathScanner::clipAALine(SplashBitmap *aaBuf,
for (; xx + 7 <= xx0; xx += 8) {
*p++ = 0x00;
}
if (xx <= xx0) {
if (xx < xx0) {
*p &= 0xff >> (xx0 & 7);
}
}
@ -406,6 +406,7 @@ void SplashXPathScanner::clipAALine(SplashBitmap *aaBuf,
}
}
xx0 = (*x1 + 1) * splashAASize;
if (xx0 > aaBuf->getWidth()) xx0 = aaBuf->getWidth();
// set [xx, xx0) to 0
if (xx < xx0) {
p = aaBuf->getDataPtr() + yy * aaBuf->getRowSize() + (xx >> 3);
@ -420,7 +421,7 @@ void SplashXPathScanner::clipAALine(SplashBitmap *aaBuf,
for (; xx + 7 <= xx0; xx += 8) {
*p++ = 0x00;
}
if (xx <= xx0) {
if (xx < xx0) {
*p &= 0xff >> (xx0 & 7);
}
}

Loading…
Cancel
Save