ConvertBits() now checks the out of range case before reading/writing the buffers. Previously it was possible to read/write one line after the buffers end because the values were not checked after line advancement. This fixes the crashing bug #850. It however reveals another bug that brings the app_server into an endless loop when using the TextFader screensaver.

git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@19626 a95241bf-73f2-0310-859d-f6bbb57e9c96

src/kits/interface/ColorConversion.cpp

@@ -721,6 +721,10 @@ ConvertBits(const srcByte *srcBits, dstByte *dstBits, int32 srcBitsLength,
 
 	for (int32 i = 0; i < height; i++) {
 		for (int32 j = 0; j < width; j++) {
+			if ((uint8 *)srcBits + sizeof(srcByte) > srcBitsEnd
+				|| (uint8 *)dstBits + sizeof(dstByte) > dstBitsEnd)
+				return B_OK;
+
 			if (srcFunc)
 				source = srcFunc((const uint8 **)&srcBits, srcOffsetX++);
 			else {
@@ -777,9 +781,6 @@ ConvertBits(const srcByte *srcBits, dstByte *dstBits, int32 srcBitsLength,
 				*dstBits = result;
 				dstBits++;
 			}
-
-			if ((uint8*)srcBits > srcBitsEnd || (uint8*)dstBits > dstBitsEnd)
-				return B_OK;
 		}
 
 		srcBits = (srcByte*)((uint8*)srcBits + srcLinePad);