i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed buffer overrun, CID 4338.

Browse Source 
git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@41182 a95241bf-73f2-0310-859d-f6bbb57e9c96
This commit is contained in:
Stephan Aßmus
2011-04-04 15:36:23 +00:00
parent 9705667601
commit 1c3b1649cd
1 changed files with 22 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/apps/icon-o-matic/generic/gui/scrollview/ScrollView.cpp
+22 -19
View File
@@ -138,31 +138,34 @@ ScrollCorner::ScrollCorner(ScrollView* scrollView)
fStartPoint(0, 0),
fStartScrollOffset(0, 0)
{
//printf("ScrollCorner::ScrollCorner(%p)\n", scrollView);
SetViewColor(B_TRANSPARENT_32_BIT);
//printf("setting up bitmap 0\n");
fBitmaps[0] = new BBitmap(BRect(0.0f, 0.0f, sBitmapWidth, sBitmapHeight), sColorSpace);
// fBitmaps[0]->SetBits((void *)sScrollCornerNormalBits, fBitmaps[0]->BitsLength(), 0L, sColorSpace);
char *bits = (char *)fBitmaps[0]->Bits();
fBitmaps[0] = new BBitmap(BRect(0.0f, 0.0f, sBitmapWidth - 1,
sBitmapHeight - 1), sColorSpace);
char* bits = (char*)fBitmaps[0]->Bits();
int32 bpr = fBitmaps[0]->BytesPerRow();
for (int i = 0; i <= sBitmapHeight; i++, bits += bpr)
memcpy(bits, &sScrollCornerNormalBits[i * sBitmapHeight * 4], sBitmapWidth * 4);
for (int i = 0; i < sBitmapHeight; i++, bits += bpr) {
memcpy(bits, &sScrollCornerNormalBits[i * sBitmapHeight * 4],
sBitmapWidth * 4);
}
//printf("setting up bitmap 1\n");
fBitmaps[1] = new BBitmap(BRect(0.0f, 0.0f, sBitmapWidth, sBitmapHeight), sColorSpace);
// fBitmaps[1]->SetBits((void *)sScrollCornerPushedBits, fBitmaps[1]->BitsLength(), 0L, sColorSpace);
bits = (char *)fBitmaps[1]->Bits();
fBitmaps[1] = new BBitmap(BRect(0.0f, 0.0f, sBitmapWidth - 1,
sBitmapHeight - 1), sColorSpace);
bits = (char*)fBitmaps[1]->Bits();
bpr = fBitmaps[1]->BytesPerRow();
for (int i = 0; i <= sBitmapHeight; i++, bits += bpr)
memcpy(bits, &sScrollCornerPushedBits[i * sBitmapHeight * 4], sBitmapWidth * 4);
for (int i = 0; i < sBitmapHeight; i++, bits += bpr) {
memcpy(bits, &sScrollCornerPushedBits[i * sBitmapHeight * 4],
sBitmapWidth * 4);
}
//printf("setting up bitmap 2\n");
fBitmaps[2] = new BBitmap(BRect(0.0f, 0.0f, sBitmapWidth, sBitmapHeight), sColorSpace);
// fBitmaps[2]->SetBits((void *)sScrollCornerDisabledBits, fBitmaps[2]->BitsLength(), 0L, sColorSpace);
bits = (char *)fBitmaps[2]->Bits();
fBitmaps[2] = new BBitmap(BRect(0.0f, 0.0f, sBitmapWidth - 1,
sBitmapHeight - 1), sColorSpace);
bits = (char*)fBitmaps[2]->Bits();
bpr = fBitmaps[2]->BytesPerRow();
for (int i = 0; i <= sBitmapHeight; i++, bits += bpr)
memcpy(bits, &sScrollCornerDisabledBits[i * sBitmapHeight * 4], sBitmapWidth * 4);
for (int i = 0; i < sBitmapHeight; i++, bits += bpr) {
memcpy(bits, &sScrollCornerDisabledBits[i * sBitmapHeight * 4],
sBitmapWidth * 4);
}
}
// destructor