pxcloud/spice
5
0
Fork 0
mirror of https://gitlab.uni-freiburg.de/opensourcevdi/spice synced 2026-01-05 03:44:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix uninitilized memory read in stroke_fill_spans()

Browse Source 
y2 was not initialized
This commit is contained in:
Alexander Larsson 2010-03-18 08:57:42 +01:00
parent b5f25486ef
commit dcef400d30
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
common/canvas_base.c
View File

@ -2422,6 +2422,7 @@ static void stroke_fill_spans(lineGC * pGC,
r.x1 = points[i].x;
r.y1 = points[i].y;
r.x2 = points[i].x + widths[i];
r.y2 = r.y1 + 1;
canvas->ops->fill_solid_rects_rop(canvas, &r, 1,
strokeGC->color, rop);
}
@ -2433,6 +2434,7 @@ static void stroke_fill_spans(lineGC * pGC,
r.x1 = points[i].x;
r.y1 = points[i].y;
r.x2 = points[i].x + widths[i];
r.y2 = r.y1 + 1;
canvas->ops->fill_tiled_rects(canvas, &r, 1,
strokeGC->tile,
strokeGC->tile_offset_x,
@ -2444,6 +2446,7 @@ static void stroke_fill_spans(lineGC * pGC,
r.x1 = points[i].x;
r.y1 = points[i].y;
r.x2 = points[i].x + widths[i];
r.y2 = r.y1 + 1;
canvas->ops->fill_tiled_rects_rop(canvas, &r, 1,
strokeGC->tile,
strokeGC->tile_offset_x,

9
server/red_worker.c
View File

@ -5949,10 +5949,15 @@ static void fill_bits(DisplayChannel *display_channel, QXLPHYSICAL *in_bitmap, D
int memslot_id;
compress_send_data_t comp_send_data;
ASSERT(*in_bitmap);
if (*in_bitmap == 0) {
ASSERT(drawable->self_bitmap);
qxl_image = (QXLImage *)drawable->self_bitmap;
} else {
qxl_image = (QXLImage *)get_virt(worker, *in_bitmap, sizeof(QXLImage),
drawable->group_id);
}
image = alloc_image(display_channel);
qxl_image = (QXLImage *)get_virt(worker, *in_bitmap, sizeof(QXLImage), drawable->group_id);
image->descriptor.id = qxl_image->descriptor.id;
image->descriptor.type = qxl_image->descriptor.type;