mirrors/FreeRDP
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Added length arguments and checks.

Browse Source
This commit is contained in:
Armin Novak 2015-08-06 11:24:42 +02:00
parent 416ac0baea
commit 4a62e6bee4
4 changed files with 57 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
client/Android/FreeRDPCore/jni/android_freerdp.c
View File

@ -1148,7 +1148,7 @@ static void copy_pixel_buffer(UINT8* dstBuf, UINT8* srcBuf, int x, int y, int wi
int length;
int scanline;
UINT8 *dstp, *srcp;
length = width * bpp;
scanline = wBuf * bpp;

9
client/X11/xf_graphics.c
View File

@ -237,9 +237,12 @@ BOOL xf_Pointer_New(rdpContext* context, rdpPointer* pointer)
return FALSE;
}
if (freerdp_image_copy_from_pointer_data((BYTE*) ci.pixels, PIXEL_FORMAT_ARGB32,
pointer->width * 4, 0, 0, pointer->width, pointer->height,
pointer->xorMaskData, pointer->andMaskData, pointer->xorBpp, xfc->palette) < 0)
if (freerdp_image_copy_from_pointer_data(
(BYTE*) ci.pixels, PIXEL_FORMAT_ARGB32,
pointer->width * 4, 0, 0, pointer->width, pointer->height,
pointer->xorMaskData, pointer->lengthXorMask,
pointer->andMaskData, pointer->lengthAndMask,
pointer->xorBpp, xfc->palette) < 0)
{
free(ci.pixels);
xf_unlock_x11(xfc, FALSE);

13
include/freerdp/codec/color.h
View File

@ -376,12 +376,12 @@ extern "C" {
#define BGR16_RGB32(_r, _g, _b, _p) \
GetBGR16(_r, _g, _b, _p); \
RGB_565_888(_r, _g, _b); \
RGB_565_888(_r, _g, _b); \
_p = RGB32(_r, _g, _b);
#define RGB32_RGB16(_r, _g, _b, _p) \
GetRGB32(_r, _g, _b, _p); \
RGB_888_565(_r, _g, _b); \
RGB_888_565(_r, _g, _b); \
_p = RGB565(_r, _g, _b);
#define RGB15_RGB16(_r, _g, _b, _p) \
@ -452,8 +452,11 @@ FREERDP_API void freerdp_clrconv_free(HCLRCONV clrconv);
FREERDP_API int freerdp_image_copy_from_monochrome(BYTE* pDstData, UINT32 DstFormat, int nDstStep, int nXDst, int nYDst,
int nWidth, int nHeight, BYTE* pSrcData, UINT32 backColor, UINT32 foreColor, BYTE* palette);
FREERDP_API int freerdp_image_copy_from_pointer_data(BYTE* pDstData, UINT32 DstFormat, int nDstStep, int nXDst, int nYDst,
int nWidth, int nHeight, BYTE* xorMask, BYTE* andMask, UINT32 xorBpp, BYTE* palette);
FREERDP_API int int freerdp_image_copy_from_pointer_data(
BYTE* pDstData, UINT32 DstFormat, int nDstStep,
int nXDst, int nYDst, int nWidth, int nHeight, BYTE* xorMask,
UINT32 xorMaskLength, BYTE* andMask, UINT32 andMaskLength,
UINT32 xorBpp, BYTE* palette);
FREERDP_API int freerdp_image8_copy(BYTE* pDstData, DWORD DstFormat, int nDstStep, int nXDst, int nYDst,
int nWidth, int nHeight, BYTE* pSrcData, DWORD SrcFormat, int nSrcStep, int nXSrc, int nYSrc, BYTE* palette);
@ -472,7 +475,7 @@ FREERDP_API int freerdp_image_move(BYTE* pData, DWORD Format, int nStep, int nXD
int nWidth, int nHeight, int nXSrc, int nYSrc);
FREERDP_API int freerdp_image_fill(BYTE* pDstData, DWORD DstFormat, int nDstStep, int nXDst, int nYDst,
int nWidth, int nHeight, UINT32 color);
FREERDP_API int freerdp_image_copy_from_retina(BYTE* pDstData, DWORD DstFormat, int nDstStep, int nXDst, int nYDst,
int nWidth, int nHeight, BYTE* pSrcData, int nSrcStep, int nXSrc, int nYSrc);

65
libfreerdp/codec/color.c
View File

@ -1036,23 +1036,23 @@ BYTE* freerdp_icon_convert(BYTE* srcData, BYTE* dstData, BYTE* mask, int width,
/* Server sends 16 bpp field, but data is usually 15-bit 555 */
bpp = 15;
}
data = freerdp_image_flip(srcData, dstData, width, height, bpp);
dstData = freerdp_image_convert(data, NULL, width, height, bpp, 32, clrconv);
_aligned_free(data);
/* Read the AND alpha plane */
/* Read the AND alpha plane */
if (bpp < 32)
{
maskIndex = 0;
icon = (UINT32*) dstData;
for (y = 0; y < height; y++)
{
for (x = 0; x < width-7; x+=8)
{
bmask = mask[maskIndex++];
for (bit = 0; bit < 8; bit++)
if ((bmask & (0x80 >> bit)) == 0)
{
@ -1061,11 +1061,11 @@ BYTE* freerdp_icon_convert(BYTE* srcData, BYTE* dstData, BYTE* mask, int width,
*tmp |= 0xFF000000;
}
}
if ((width % 8) != 0)
{
bmask = mask[maskIndex++];
for (bit = 0; bit < width % 8; bit++)
if ((bmask & (0x80 >> bit)) == 0)
{
@ -1074,7 +1074,7 @@ BYTE* freerdp_icon_convert(BYTE* srcData, BYTE* dstData, BYTE* mask, int width,
*tmp |= 0xFF000000;
}
}
/* Skip padding */
if ((width % 32) != 0)
maskIndex += (32 - (width % 32)) / 8;
@ -1426,8 +1426,12 @@ void freerdp_alpha_cursor_convert(BYTE* alphaData, BYTE* xorMask, BYTE* andMask,
* http://msdn.microsoft.com/en-us/library/windows/hardware/ff556138/
*/
int freerdp_image_copy_from_pointer_data(BYTE* pDstData, UINT32 DstFormat, int nDstStep, int nXDst, int nYDst,
int nWidth, int nHeight, BYTE* xorMask, BYTE* andMask, UINT32 xorBpp, BYTE* palette)
int freerdp_image_copy_from_pointer_data(BYTE* pDstData, UINT32 DstFormat,
int nDstStep, int nXDst, int nYDst,
int nWidth, int nHeight, BYTE* xorMask,
UINT32 xorMaskLength, BYTE* andMask,
UINT32 andMaskLength, UINT32 xorBpp,
BYTE* palette)
{
int x, y;
BOOL vFlip;
@ -1463,7 +1467,7 @@ int freerdp_image_copy_from_pointer_data(BYTE* pDstData, UINT32 DstFormat, int n
andStep = (nWidth + 7) / 8;
andStep += (andStep % 2);
if (!xorMask)
if (!xorMask || (xorMaskLength == 0))
return -1;
if (dstBytesPerPixel == 4)
@ -1472,12 +1476,18 @@ int freerdp_image_copy_from_pointer_data(BYTE* pDstData, UINT32 DstFormat, int n
if (xorBpp == 1)
{
if (!andMask)
if (!andMask || (andMaskLength == 0))
return -1;
xorStep = (nWidth + 7) / 8;
xorStep += (xorStep % 2);
if (xorStep * nHeight > xorMaskLength)
return -1;
if (andStep * nHeight > andMaskLength)
return -1;
pDstPixel = (UINT32*) &pDstData[(nYDst * nDstStep) + (nXDst * 4)];
for (y = 0; y < nHeight; y++)
@ -1531,6 +1541,15 @@ int freerdp_image_copy_from_pointer_data(BYTE* pDstData, UINT32 DstFormat, int n
return -1;
}
if (xorStep * nHeight > xorMaskLength)
return -1;
if (andMask)
{
if (andStep * nHeight > andMaskLength)
return -1;
}
for (y = 0; y < nHeight; y++)
{
andBit = 0x80;
@ -3682,52 +3701,52 @@ int freerdp_image_copy_from_retina(BYTE* pDstData, DWORD DstFormat, int nDstStep
int srcBytesPerPixel;
int dstBitsPerPixel;
int dstBytesPerPixel;
srcBitsPerPixel = 24;
srcBytesPerPixel = 8;
if (nSrcStep < 0)
nSrcStep = srcBytesPerPixel * nWidth;
dstBitsPerPixel = FREERDP_PIXEL_FORMAT_DEPTH(DstFormat);
dstBytesPerPixel = (FREERDP_PIXEL_FORMAT_BPP(DstFormat) / 8);
if (nDstStep < 0)
nDstStep = dstBytesPerPixel * nWidth;
nSrcPad = (nSrcStep - (nWidth * srcBytesPerPixel));
nDstPad = (nDstStep - (nWidth * dstBytesPerPixel));
if (dstBytesPerPixel == 4)
{
UINT32 R, G, B;
BYTE* pSrcPixel;
BYTE* pDstPixel;
pSrcPixel = &pSrcData[(nYSrc * nSrcStep) + (nXSrc * 4)];
pDstPixel = &pDstData[(nYDst * nDstStep) + (nXDst * 4)];
for (y = 0; y < nHeight; y++)
{
for (x = 0; x < nWidth; x++)
{
/* simple box filter scaling, could be improved with better algorithm */
B = pSrcPixel[0] + pSrcPixel[4] + pSrcPixel[nSrcStep + 0] + pSrcPixel[nSrcStep + 4];
G = pSrcPixel[1] + pSrcPixel[5] + pSrcPixel[nSrcStep + 1] + pSrcPixel[nSrcStep + 5];
R = pSrcPixel[2] + pSrcPixel[6] + pSrcPixel[nSrcStep + 2] + pSrcPixel[nSrcStep + 6];
pSrcPixel += 8;
*pDstPixel++ = (BYTE) (B >> 2);
*pDstPixel++ = (BYTE) (G >> 2);
*pDstPixel++ = (BYTE) (R >> 2);
*pDstPixel++ = 0xFF;
}
pSrcPixel = &pSrcPixel[nSrcPad + nSrcStep];
pDstPixel = &pDstPixel[nDstPad];
}
}
return 1;
}