| Message ID | 5784B8EB.7010008@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Di, 2016-07-12 at 17:31 +0800, Herongguang (Stephen) wrote: > In tight_encode_indexed_rect32, buf(or src)’s size is count. In for loop, > the logic is supposed to be that i is an index into src, i should be > incremented when incrementing src. > > This is broken when src is incremented but i is not before while loop, > resulting in off-by-one bug in while loop. > > Signed-off-by: He Rongguang <herongguang.he@huawei.com> Added to vnc queue. Patch is whitespace mangled, had to use "patch --ignore-whitespace" to get it applied. Can you please use 'git send-email' to send patches in the future? That is the best way to avoid your mail client breaking patches. thanks, Gerd
diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c index e5cba0e..678c5df 100644 --- a/ui/vnc-enc-tight.c +++ b/ui/vnc-enc-tight.c @@ -461,9 +461,10 @@ static int tight_fill_palette(VncState *vs, int x, int y, \ src = (uint##bpp##_t *) buf; \ \ - for (i = 0; i < count; i++) { \ + for (i = 0; i < count; ) { \ \ rgb = *src++; \ + i++; \ rep = 0; \ while (i < count && *src == rgb) { \ rep++, src++, i++; \
In tight_encode_indexed_rect32, buf(or src)’s size is count. In for loop, the logic is supposed to be that i is an index into src, i should be incremented when incrementing src. This is broken when src is incremented but i is not before while loop, resulting in off-by-one bug in while loop. Signed-off-by: He Rongguang <herongguang.he@huawei.com> --- ui/vnc-enc-tight.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)