qi-hardware/gmenu2x
1
0
Fork 0
mirror of git://projects.qi-hardware.com/gmenu2x.git synced 2024-11-05 06:58:27 +02:00
Code

Fix out of bounds read

Browse Source
This commit is contained in:
Lars-Peter Clausen 2010-05-03 23:53:06 +02:00
parent dc65381ea4
commit c9c915c892
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/sfontplus.cpp
View File

@ -9,6 +9,8 @@ using namespace std;
Uint32 SFontPlus::getPixel(Sint32 x, Sint32 y) { Uint32 SFontPlus::getPixel(Sint32 x, Sint32 y) {
assert(x>=0); assert(x>=0);
assert(x<surface->w); assert(x<surface->w);
assert(y>=0);
assert(y<surface->h);
Uint32 Bpp = surface->format->BytesPerPixel; Uint32 Bpp = surface->format->BytesPerPixel;
@ -108,12 +110,12 @@ void SFontPlus::initFont(SDL_Surface *font, const string &characters) {
Uint32 colKey = getPixel(0,surface->h-1); Uint32 colKey = getPixel(0,surface->h-1);
SDL_SetColorKey(surface, SDL_SRCCOLORKEY, colKey); SDL_SetColorKey(surface, SDL_SRCCOLORKEY, colKey);
string::size_type pos = characters.find("0")*2; string::size_type pos = characters.find("0")*2;
SDL_Rect srcrect = {charpos[pos], 1, charpos[pos+2] - charpos[pos], surface->h-1}; SDL_Rect srcrect = {charpos[pos], 1, charpos[pos+2] - charpos[pos], surface->h - 1};
uint y = srcrect.h+1; uint y = srcrect.h;
bool nonKeyFound = false; bool nonKeyFound = false;
while (y-->0 && !nonKeyFound) { while (y-- > 0 && !nonKeyFound) {
uint x = srcrect.w+1; uint x = srcrect.w;
while (x-->0 && !nonKeyFound) while (x-- > 0 && !nonKeyFound)
nonKeyFound = getPixel(x+srcrect.x,y+srcrect.y) != colKey; nonKeyFound = getPixel(x+srcrect.x,y+srcrect.y) != colKey;
} }
lineHeight = y+1; lineHeight = y+1;