mirrors/FreeRDP
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libfreerdp-codec: fix off-by-one memory corruption in ico parser

Browse Source
This commit is contained in:
Dorian Johnson 2012-05-23 16:18:39 -05:00
parent a43378ff86
commit a91eca4480
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libfreerdp-codec/color.c
View File

@ -822,7 +822,7 @@ uint8* freerdp_icon_convert(uint8* srcData, uint8* dstData, uint8* mask, int wid
for (bit = 0; bit < 8; bit++)
if ((bmask & (0x80 >> bit)) == 0)
*(icon + (height - y) * width + x + bit) |= 0xFF000000;
*(icon + (height - y - 1) * width + x + bit) |= 0xFF000000;
}
if ((width % 8) != 0)
@ -831,7 +831,7 @@ uint8* freerdp_icon_convert(uint8* srcData, uint8* dstData, uint8* mask, int wid
for (bit = 0; bit < width % 8; bit++)
if ((bmask & (0x80 >> bit)) == 0)
*(icon + (height - y) * width + x + bit) |= 0xFF000000;
*(icon + (height - y - 1) * width + x + bit) |= 0xFF000000;
}
/* Skip padding */
@ -840,8 +840,6 @@ uint8* freerdp_icon_convert(uint8* srcData, uint8* dstData, uint8* mask, int wid
}
}
free(mask);
return dstData;
}