From 4ad4c6c1b8cff539aa22f09584358130dfef4630 Mon Sep 17 00:00:00 2001 From: Michael Lotz Date: Tue, 26 Dec 2006 13:22:25 +0000 Subject: [PATCH] ConvertBits() now checks the out of range case before reading/writing the buffers. Previously it was possible to read/write one line after the buffers end because the values were not checked after line advancement. This fixes the crashing bug #850. It however reveals another bug that brings the app_server into an endless loop when using the TextFader screensaver. git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@19626 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- src/kits/interface/ColorConversion.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/kits/interface/ColorConversion.cpp b/src/kits/interface/ColorConversion.cpp index 1be879f461..1468e67589 100644 --- a/src/kits/interface/ColorConversion.cpp +++ b/src/kits/interface/ColorConversion.cpp @@ -721,6 +721,10 @@ ConvertBits(const srcByte *srcBits, dstByte *dstBits, int32 srcBitsLength, for (int32 i = 0; i < height; i++) { for (int32 j = 0; j < width; j++) { + if ((uint8 *)srcBits + sizeof(srcByte) > srcBitsEnd + || (uint8 *)dstBits + sizeof(dstByte) > dstBitsEnd) + return B_OK; + if (srcFunc) source = srcFunc((const uint8 **)&srcBits, srcOffsetX++); else { @@ -777,9 +781,6 @@ ConvertBits(const srcByte *srcBits, dstByte *dstBits, int32 srcBitsLength, *dstBits = result; dstBits++; } - - if ((uint8*)srcBits > srcBitsEnd || (uint8*)dstBits > dstBitsEnd) - return B_OK; } srcBits = (srcByte*)((uint8*)srcBits + srcLinePad);