When creating a picture with data, the app_server was writing beyond the

allocated memory, without telling anyone. That was causing bad things to 
happen. Flattening and unflattening BPictures now works, and 
consequently, printing works too. Bug #1014 is fixed.


git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@20285 a95241bf-73f2-0310-859d-f6bbb57e9c96

src/servers/app/ServerApp.cpp

@@ -686,18 +686,12 @@ ServerApp::_DispatchMessage(int32 code, BPrivate::LinkReceiver& link)
 		{
 			// TODO: Maybe rename this to AS_UPLOAD_PICTURE ?
 			STRACE(("ServerApp %s: Create Picture\n", Signature()));
+			status_t status = B_ERROR;			
 			ServerPicture *picture = CreatePicture();
-			if (picture != NULL) {
+			if (picture != NULL)
-				int32 subPicturesCount = 0;
+				status = picture->ImportData(link);
-				link.Read<int32>(&subPicturesCount);
+			
-				for (int32 c = 0; c < subPicturesCount; c++) {
+			if (status == B_OK) {
-					// TODO: Support nested pictures
-				} 
-				
-				int32 size = 0;
-				link.Read<int32>(&size);
-				link.Read(const_cast<void *>(picture->Data()), size);
-				
 				fLink.StartMessage(B_OK);
 				fLink.Attach<int32>(picture->Token());
 			} else

src/servers/app/ServerPicture.cpp

@@ -15,6 +15,7 @@
 #include "ViewLayer.h"
 #include "WindowLayer.h"
 
+#include <LinkReceiver.h>
 #include <PicturePlayer.h>
 #include <PictureProtocol.h>
 #include <ServerProtocol.h>
@@ -661,3 +662,27 @@ ServerPicture::Play(ViewLayer *view)
 	PicturePlayer player(const_cast<void *>(fData.Buffer()), fData.BufferLength(), NULL);
 	player.Play(const_cast<void **>(tableEntries), sizeof(tableEntries) / sizeof(void *), view);
 }
+
+
+status_t
+ServerPicture::ImportData(BPrivate::LinkReceiver &link)
+{
+	int32 subPicturesCount = 0;
+	link.Read<int32>(&subPicturesCount);
+	for (int32 c = 0; c < subPicturesCount; c++) {
+		// TODO: Support nested pictures
+	} 
+	
+	int32 size = 0;
+	link.Read<int32>(&size);
+	if (fData.SetSize(size) != B_OK)
+		return B_ERROR;
+
+	// TODO: The best way to do this would be to read the data into
+	// a temporary buffer, and then use the BMallocIO::Write() method,
+	// but this way we avoid an extra copy. Unfortunately BMallocIO::Write()
+	// only accepts a pointer to raw data...
+	link.Read(const_cast<void *>(fData.Buffer()), size);
+
+	return B_OK;
+}

src/servers/app/ServerPicture.h

@@ -7,6 +7,7 @@
 
 class ServerApp;
 class ViewLayer;
+class BPrivate::LinkReceiver;
 class ServerPicture : public PictureDataWriter {
 public:	
 		int32		Token() { return fToken; }
@@ -23,6 +24,8 @@ public:
 		
 		const void	*Data() const { return fData.Buffer(); }
 		int32		DataLength() const { return fData.BufferLength(); }
+		
+		status_t	ImportData(BPrivate::LinkReceiver &link);
 
 private:
 friend class	ServerApp;
@@ -30,7 +33,7 @@ friend class	ServerApp;
 		ServerPicture();
 		ServerPicture(const ServerPicture &);
 		~ServerPicture();
-		
+
 		int32		fToken;
 		BMallocIO	fData;
 		// DrawState	*fState;