frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hw/xwin: Fix an issue in winSetSpansNativeGDI() identifed by -Warray-bounds 

The BITMAPINFO local only has room for a single RBGQUAD in bmiColors, but we
access two (black and white for a mono-color DIB).  Fix by changing to a dynamic
allocation big enough for a BITMAPINFO and a RGBQUAD.

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
This commit is contained in:
Jon TURNEY 2013-04-07 23:59:44 +01:00
parent 784c006adb
commit 4bfb2dce5e
1 changed files with 29 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
hw/xwin/winsetsp.c
View File

@ -46,7 +46,7 @@ winSetSpansNativeGDI(DrawablePtr pDrawable,
PixmapPtr pPixmap = NULL;
winPrivPixmapPtr pPixmapPriv = NULL;
HBITMAP hbmpOrig = NULL;
BITMAPINFO bmi;
BITMAPINFO *pbmi;
HRGN hrgn = NULL, combined = NULL;
int nbox;
BoxPtr pbox;
@ -57,6 +57,8 @@ winSetSpansNativeGDI(DrawablePtr pDrawable,
if (!nbox)
return;
pbmi = malloc(sizeof(BITMAPINFO) + sizeof(RGBQUAD));
combined = CreateRectRgn(pbox->x1, pbox->y1, pbox->x2, pbox->y2);
nbox--;
pbox++;
@ -86,19 +88,20 @@ winSetSpansNativeGDI(DrawablePtr pDrawable,
"failed on pPixmapPriv->hBitmap\n");
while (iSpans--) {
ZeroMemory(&bmi, sizeof(BITMAPINFO));
bmi.bmiHeader.biSize = sizeof(BITMAPINFOHEADER);
bmi.bmiHeader.biWidth = *piWidths;
bmi.bmiHeader.biHeight = 1;
bmi.bmiHeader.biPlanes = 1;
bmi.bmiHeader.biBitCount = pDrawable->depth;
bmi.bmiHeader.biCompression = BI_RGB;
ZeroMemory(pbmi, sizeof(BITMAPINFO));
pbmi->bmiHeader.biSize = sizeof(BITMAPINFOHEADER);
pbmi->bmiHeader.biWidth = *piWidths;
pbmi->bmiHeader.biHeight = 1;
pbmi->bmiHeader.biPlanes = 1;
pbmi->bmiHeader.biBitCount = pDrawable->depth;
pbmi->bmiHeader.biCompression = BI_RGB;
/* Setup color table for mono DIBs */
if (pDrawable->depth == 1) {
bmi.bmiColors[1].rgbBlue = 255;
bmi.bmiColors[1].rgbGreen = 255;
bmi.bmiColors[1].rgbRed = 255;
RGBQUAD *bmiColors = &(pbmi->bmiColors[0]);
bmiColors[1].rgbBlue = 255;
bmiColors[1].rgbGreen = 255;
bmiColors[1].rgbRed = 255;
}
StretchDIBits(pGCPriv->hdcMem,
@ -107,7 +110,7 @@ winSetSpansNativeGDI(DrawablePtr pDrawable,
0, 0,
*piWidths, 1,
pSrcs,
(BITMAPINFO *) &bmi,
(BITMAPINFO *) pbmi,
DIB_RGB_COLORS, g_copyROP[pGC->alu]);
pSrcs += PixmapBytePad(*piWidths, pDrawable->depth);
@ -129,19 +132,20 @@ winSetSpansNativeGDI(DrawablePtr pDrawable,
combined = NULL;
while (iSpans--) {
ZeroMemory(&bmi, sizeof(BITMAPINFO));
bmi.bmiHeader.biSize = sizeof(BITMAPINFOHEADER);
bmi.bmiHeader.biWidth = *piWidths;
bmi.bmiHeader.biHeight = 1;
bmi.bmiHeader.biPlanes = 1;
bmi.bmiHeader.biBitCount = pDrawable->depth;
bmi.bmiHeader.biCompression = BI_RGB;
ZeroMemory(pbmi, sizeof(BITMAPINFO));
pbmi->bmiHeader.biSize = sizeof(BITMAPINFOHEADER);
pbmi->bmiHeader.biWidth = *piWidths;
pbmi->bmiHeader.biHeight = 1;
pbmi->bmiHeader.biPlanes = 1;
pbmi->bmiHeader.biBitCount = pDrawable->depth;
pbmi->bmiHeader.biCompression = BI_RGB;
/* Setup color table for mono DIBs */
if (pDrawable->depth == 1) {
bmi.bmiColors[1].rgbBlue = 255;
bmi.bmiColors[1].rgbGreen = 255;
bmi.bmiColors[1].rgbRed = 255;
RGBQUAD *bmiColors = &(pbmi->bmiColors[0]);
bmiColors[1].rgbBlue = 255;
bmiColors[1].rgbGreen = 255;
bmiColors[1].rgbRed = 255;
}
StretchDIBits(pGCPriv->hdc,
@ -150,7 +154,7 @@ winSetSpansNativeGDI(DrawablePtr pDrawable,
0, 0,
*piWidths, 1,
pSrcs,
(BITMAPINFO *) &bmi,
(BITMAPINFO *) pbmi,
DIB_RGB_COLORS, g_copyROP[pGC->alu]);
pSrcs += PixmapBytePad(*piWidths, pDrawable->depth);
@ -166,4 +170,6 @@ winSetSpansNativeGDI(DrawablePtr pDrawable,
FatalError("\nwinSetSpansNativeGDI - Unknown drawable type\n\n");
break;
}
free(pbmi);
}