mirrors/neutrino
1
0
Fork 0
mirror of https://github.com/tuxbox-neutrino/neutrino.git synced 2025-08-26 23:13:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

tuxtxt: try to fix use sbit->buffer after free; test on Phoenix site 280

Browse Source
This commit is contained in:
Jacek Jendrzej
2022-03-26 17:17:14 +01:00
parent 8f45184162
commit 09f067da20
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
lib/libtuxtxt/tuxtxt.cpp
View File

@@ -4817,21 +4817,25 @@ void RenderChar(int Char, tstPageAttr *Attribute, int zoom, int yoffset)
if ((glyph = FT_Get_Char_Index(face, Char))) if ((glyph = FT_Get_Char_Index(face, Char)))
{ {
sbitbuffer = (unsigned char*) localbuffer;
memmove(sbitbuffer,sbit->buffer,sbit->pitch*sbit->height);
int height = sbit->height;
int p = sbit->pitch;
if ((error = FTC_SBitCache_Lookup(cache, &typettf, glyph, &sbit_diacrit, NULL)) == 0) if ((error = FTC_SBitCache_Lookup(cache, &typettf, glyph, &sbit_diacrit, NULL)) == 0)
{ {
sbitbuffer = (unsigned char*) localbuffer; for (Row = 0; Row < height; Row++)
memmove(sbitbuffer,sbit->buffer,sbit->pitch*sbit->height);
for (Row = 0; Row < sbit->height; Row++)
{ {
for (Pitch = 0; Pitch < sbit->pitch; Pitch++) for (Pitch = 0; Pitch < p; Pitch++)
{ {
if (sbit_diacrit->pitch > Pitch && sbit_diacrit->height > Row) if (sbit_diacrit->pitch > Pitch && sbit_diacrit->height > Row)
if((sbit_diacrit->pitch*sbit_diacrit->height) > (Row*sbit->pitch+Pitch)) if((sbit_diacrit->pitch*sbit_diacrit->height) > (Row*p+Pitch))
sbitbuffer[Row*sbit->pitch+Pitch] |= sbit_diacrit->buffer[Row*sbit->pitch+Pitch]; sbitbuffer[Row*p+Pitch] |= sbit_diacrit->buffer[Row*p+Pitch];
} }
} }
if ((error = FTC_SBitCache_Lookup(cache, &typettf, glyph, &sbit, NULL)) != 0)
{
return;
}
} }
} }
} }