diff options
| author | Herongguang (Stephen) <herongguang.he@huawei.com> | 2016-07-12 17:31:23 +0800 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2016-09-28 10:48:17 -0500 |
| commit | 98b81297bfa7a1a7acfd8689f7c6447cbc128bfa (patch) | |
| tree | 55657ab432f07bdde5fb16d6e6edd275717d25fd | |
| parent | 8ef7abeccf527029c3b2e70ec585f1788fa2e007 (diff) | |
| download | qemu-98b81297bfa7a1a7acfd8689f7c6447cbc128bfa.zip qemu-98b81297bfa7a1a7acfd8689f7c6447cbc128bfa.tar.gz qemu-98b81297bfa7a1a7acfd8689f7c6447cbc128bfa.tar.bz2 | |
vnc-enc-tight: fix off-by-one bug
In tight_encode_indexed_rect32, buf(or src)’s size is count. In for loop,
the logic is supposed to be that i is an index into src, i should be
incremented when incrementing src.
This is broken when src is incremented but i is not before while loop,
resulting in off-by-one bug in while loop.
Signed-off-by: He Rongguang <herongguang.he@huawei.com>
Message-id: 5784B8EB.7010008@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 3f7e51bca3ef2d64c53b35ab9916c99e4a9e3c69)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | ui/vnc-enc-tight.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c index e5cba0e..678c5df 100644 --- a/ui/vnc-enc-tight.c +++ b/ui/vnc-enc-tight.c @@ -461,9 +461,10 @@ static int tight_fill_palette(VncState *vs, int x, int y, \ src = (uint##bpp##_t *) buf; \ \ - for (i = 0; i < count; i++) { \ + for (i = 0; i < count; ) { \ \ rgb = *src++; \ + i++; \ rep = 0; \ while (i < count && *src == rgb) { \ rep++, src++, i++; \ |