[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] vnc-enc-tight: fix off-by-one bug
From: |
Herongguang (Stephen) |
Subject: |
[Qemu-devel] [PATCH] vnc-enc-tight: fix off-by-one bug |
Date: |
Tue, 12 Jul 2016 17:31:23 +0800 |
User-agent: |
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1 |
In tight_encode_indexed_rect32, buf(or src)’s size is count. In for loop,
the logic is supposed to be that i is an index into src, i should be
incremented when incrementing src.
This is broken when src is incremented but i is not before while loop,
resulting in off-by-one bug in while loop.
Signed-off-by: He Rongguang <address@hidden>
---
ui/vnc-enc-tight.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c
index e5cba0e..678c5df 100644
--- a/ui/vnc-enc-tight.c
+++ b/ui/vnc-enc-tight.c
@@ -461,9 +461,10 @@ static int tight_fill_palette(VncState *vs, int x, int y,
\
src = (uint##bpp##_t *) buf; \
\
- for (i = 0; i < count; i++) { \
+ for (i = 0; i < count; ) { \
\
rgb = *src++; \
+ i++; \
rep = 0; \
while (i < count && *src == rgb) { \
rep++, src++, i++; \
--
1.8.3.4
- [Qemu-devel] [PATCH] vnc-enc-tight: fix off-by-one bug,
Herongguang (Stephen) <=