i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed buffer overrun, CID 4338.

Browse Source 
git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@41182 a95241bf-73f2-0310-859d-f6bbb57e9c96
This commit is contained in:
Stephan Aßmus
2011-04-04 15:36:23 +00:00
parent 9705667601
commit 1c3b1649cd
1 changed files with 22 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/apps/icon-o-matic/generic/gui/scrollview/ScrollView.cpp
+19 -16
View File
@@ -138,31 +138,34 @@ ScrollCorner::ScrollCorner(ScrollView* scrollView)
fStartPoint(0, 0), fStartPoint(0, 0),
fStartScrollOffset(0, 0) fStartScrollOffset(0, 0)
{ {
//printf("ScrollCorner::ScrollCorner(%p)\n", scrollView);
SetViewColor(B_TRANSPARENT_32_BIT); SetViewColor(B_TRANSPARENT_32_BIT);
//printf("setting up bitmap 0\n");
fBitmaps[0] = new BBitmap(BRect(0.0f, 0.0f, sBitmapWidth, sBitmapHeight), sColorSpace); fBitmaps[0] = new BBitmap(BRect(0.0f, 0.0f, sBitmapWidth - 1,
// fBitmaps[0]->SetBits((void *)sScrollCornerNormalBits, fBitmaps[0]->BitsLength(), 0L, sColorSpace); sBitmapHeight - 1), sColorSpace);
char* bits = (char*)fBitmaps[0]->Bits(); char* bits = (char*)fBitmaps[0]->Bits();
int32 bpr = fBitmaps[0]->BytesPerRow(); int32 bpr = fBitmaps[0]->BytesPerRow();
for (int i = 0; i <= sBitmapHeight; i++, bits += bpr) for (int i = 0; i < sBitmapHeight; i++, bits += bpr) {
memcpy(bits, &sScrollCornerNormalBits[i * sBitmapHeight * 4], sBitmapWidth * 4); memcpy(bits, &sScrollCornerNormalBits[i * sBitmapHeight * 4],
sBitmapWidth * 4);
}
//printf("setting up bitmap 1\n"); fBitmaps[1] = new BBitmap(BRect(0.0f, 0.0f, sBitmapWidth - 1,
fBitmaps[1] = new BBitmap(BRect(0.0f, 0.0f, sBitmapWidth, sBitmapHeight), sColorSpace); sBitmapHeight - 1), sColorSpace);
// fBitmaps[1]->SetBits((void *)sScrollCornerPushedBits, fBitmaps[1]->BitsLength(), 0L, sColorSpace);
bits = (char*)fBitmaps[1]->Bits(); bits = (char*)fBitmaps[1]->Bits();
bpr = fBitmaps[1]->BytesPerRow(); bpr = fBitmaps[1]->BytesPerRow();
for (int i = 0; i <= sBitmapHeight; i++, bits += bpr) for (int i = 0; i < sBitmapHeight; i++, bits += bpr) {
memcpy(bits, &sScrollCornerPushedBits[i * sBitmapHeight * 4], sBitmapWidth * 4); memcpy(bits, &sScrollCornerPushedBits[i * sBitmapHeight * 4],
sBitmapWidth * 4);
}
//printf("setting up bitmap 2\n"); fBitmaps[2] = new BBitmap(BRect(0.0f, 0.0f, sBitmapWidth - 1,
fBitmaps[2] = new BBitmap(BRect(0.0f, 0.0f, sBitmapWidth, sBitmapHeight), sColorSpace); sBitmapHeight - 1), sColorSpace);
// fBitmaps[2]->SetBits((void *)sScrollCornerDisabledBits, fBitmaps[2]->BitsLength(), 0L, sColorSpace);
bits = (char*)fBitmaps[2]->Bits(); bits = (char*)fBitmaps[2]->Bits();
bpr = fBitmaps[2]->BytesPerRow(); bpr = fBitmaps[2]->BytesPerRow();
for (int i = 0; i <= sBitmapHeight; i++, bits += bpr) for (int i = 0; i < sBitmapHeight; i++, bits += bpr) {
memcpy(bits, &sScrollCornerDisabledBits[i * sBitmapHeight * 4], sBitmapWidth * 4); memcpy(bits, &sScrollCornerDisabledBits[i * sBitmapHeight * 4],
sBitmapWidth * 4);
}
} }
// destructor // destructor