From 0ce9ba6ba32a6e28971899c78b83ae4c63b231fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Axel=20D=C3=B6rfler?= <axeld@pinc-software.de>
Date: Wed, 15 Mar 2006 23:22:27 +0000
Subject: [PATCH] * BPrivate::ConvertBits() did not take the source or
 destination bits length   into account when copying to the same color space
 (new code isn't that fast,   but it works). * BBitmap::ImportBits() did not
 take the specified offset into account at all.   This fixes bug #313.

git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@16812 a95241bf-73f2-0310-859d-f6bbb57e9c96
---
 src/kits/interface/Bitmap.cpp          |  4 ++--
 src/kits/interface/ColorConversion.cpp | 10 ++++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/kits/interface/Bitmap.cpp b/src/kits/interface/Bitmap.cpp
index 0c4098c75d..98d2fa390e 100644
--- a/src/kits/interface/Bitmap.cpp
+++ b/src/kits/interface/Bitmap.cpp
@@ -513,8 +513,8 @@ BBitmap::ImportBits(const void *data, int32 length, int32 bpr, int32 offset,
 	if (bpr < 0)
 		bpr = get_bytes_per_row(colorSpace, width);
 
-	return BPrivate::ConvertBits(data, fBasePtr, length, fSize, bpr,
-		fBytesPerRow, colorSpace, fColorSpace, width,
+	return BPrivate::ConvertBits(data, (uint8*)fBasePtr + offset, length,
+		fSize - offset, bpr, fBytesPerRow, colorSpace, fColorSpace, width,
 		fBounds.IntegerHeight() + 1);
 }
 
diff --git a/src/kits/interface/ColorConversion.cpp b/src/kits/interface/ColorConversion.cpp
index 944afb9cc0..c9f3881ff3 100644
--- a/src/kits/interface/ColorConversion.cpp
+++ b/src/kits/interface/ColorConversion.cpp
@@ -685,8 +685,18 @@ ConvertBits(const srcByte *srcBits, dstByte *dstBits, int32 srcBitsLength,
 	if (srcColorSpace == dstColorSpace && srcBitsPerPixel % 8 == 0) {
 		int32 copyCount = (width * srcBitsPerPixel) >> 3;
 		for (int32 i = 0; i < height; i++) {
+			// make sure we don't write beyond the bits size
+			if (copyCount > srcBitsLength)
+				copyCount = srcBitsLength;
+			if (copyCount > dstBitsLength)
+				copyCount = dstBitsLength;
+			if (copyCount == 0)
+				break;
+
 			memcpy(dstBits, srcBits, copyCount);
 
+			srcBitsLength -= copyCount;
+			dstBitsLength -= copyCount;
 			(char *)srcBits += srcBytesPerRow;
 			(char *)dstBits += dstBytesPerRow;