[Gnash-commit] [SCM] Gnash branch, master, updated. release_0_8_9_final-1631-g867fde9

[Bastiaan Jacques]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Gnash".

The branch, master has been updated
       via  867fde931525d6b453fe741b812a06c58ddbce62 (commit)
      from  ae23c3cf66265fccad2241878f1d19240c5fdfc2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
http://git.savannah.gnu.org/cgit//commit/?id=867fde931525d6b453fe741b812a06c58ddbce62


commit 867fde931525d6b453fe741b812a06c58ddbce62
Author: Bastiaan Jacques <address@hidden>
Date:   Tue Jul 2 13:19:06 2013 +0200

    Savannah #37629: Avoid buffer overflows resulting from copying RGBA data 
into an RGB buffer.

diff --git a/libbase/GnashImage.cpp b/libbase/GnashImage.cpp
index 03a6939..e08071c 100644
--- a/libbase/GnashImage.cpp
+++ b/libbase/GnashImage.cpp
@@ -301,18 +301,25 @@ Input::readSWFJpeg3(boost::shared_ptr<IOChannel> in)
 
     im.reset(new ImageRGBA(width, height));
 
-    boost::scoped_array<GnashImage::value_type> line(
+    if (j_in->imageType() == TYPE_RGBA) {
+
+        for (size_t y = 0; y < height; ++y) {
+            j_in->readScanline(scanline(*im, y));
+        }
+    } else {
+        boost::scoped_array<GnashImage::value_type> line(
             new GnashImage::value_type[3 * width]);
 
-    for (size_t y = 0; y < height; ++y) {
-        j_in->readScanline(line.get());
+        for (size_t y = 0; y < height; ++y) {
+            j_in->readScanline(line.get());
 
-        GnashImage::iterator data = scanline(*im, y);
-        for (size_t x = 0; x < width; ++x) {
-            data[4*x+0] = line[3*x+0];
-            data[4*x+1] = line[3*x+1];
-            data[4*x+2] = line[3*x+2];
-            data[4*x+3] = 255;
+            GnashImage::iterator data = scanline(*im, y);
+            for (size_t x = 0; x < width; ++x) {
+                data[4*x+0] = line[3*x+0];
+                data[4*x+1] = line[3*x+1];
+                data[4*x+2] = line[3*x+2];
+                data[4*x+3] = 255;
+            }
         }
     }
 

-----------------------------------------------------------------------

Summary of changes:
 libbase/GnashImage.cpp |   25 ++++++++++++++++---------
 1 files changed, 16 insertions(+), 9 deletions(-)


hooks/post-receive
-- 
Gnash