openkylin
/
qemu
mirror of https://gitee.com/openkylin/qemu.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

vnc-enc-tight: fix off-by-one bug 

In tight_encode_indexed_rect32, buf(or src)’s size is count. In for loop,
the logic is supposed to be that i is an index into src, i should be
incremented when incrementing src.

This is broken when src is incremented but i is not before while loop,
resulting in off-by-one bug in while loop.

Signed-off-by: He Rongguang <herongguang.he@huawei.com>
Message-id: 5784B8EB.7010008@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Herongguang (Stephen) 2016-07-12 17:31:23 +08:00 committed by Gerd Hoffmann
parent 5a8be0f73d
commit 3f7e51bca3
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ui/vnc-enc-tight.c
View File

@ -461,9 +461,10 @@ static int tight_fill_palette(VncState *vs, int x, int y,
\
src = (uint##bpp##_t *) buf; \
\
for (i = 0; i < count; i++) { \
for (i = 0; i < count; ) { \
\
rgb = *src++; \
i++; \
rep = 0; \
while (i < count && *src == rgb) { \
rep++, src++, i++; \