From 08f914dc676137720fa83b6621d16d01ddd463ca Mon Sep 17 00:00:00 2001 From: Oliver Tappe Date: Sun, 26 Dec 2010 15:50:08 +0000 Subject: [PATCH] Fix CID-8112 & -8113 (strange pointer arithmetic) * BShape:: AddShape(): drop manual multiplication in typed pointer arithmetic - addding the number of elements to a typed pointer will already move that pointer in steps of sizeof(type). The effect of this bug would be overwritten memory somewhere behind the data array. git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@39951 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- src/kits/interface/Shape.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/kits/interface/Shape.cpp b/src/kits/interface/Shape.cpp index 3666d4face..0f811be3e9 100644 --- a/src/kits/interface/Shape.cpp +++ b/src/kits/interface/Shape.cpp @@ -343,11 +343,11 @@ BShape::AddShape(const BShape* otherShape) if (!AllocateOps(otherData->opCount) || !AllocatePts(otherData->ptCount)) return B_NO_MEMORY; - memcpy(data->opList + data->opCount * sizeof(uint32), otherData->opList, + memcpy(data->opList + data->opCount, otherData->opList, otherData->opCount * sizeof(uint32)); data->opCount += otherData->opCount; - memcpy(data->ptList + data->ptCount * sizeof(BPoint), otherData->ptList, + memcpy(data->ptList + data->ptCount, otherData->ptList, otherData->ptCount * sizeof(BPoint)); data->ptCount += otherData->ptCount;