mirrors/neutrino
1
0
Fork 0
mirror of https://github.com/tuxbox-neutrino/neutrino.git synced 2025-08-26 23:13:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

tuxtxt: try to fix use sbit->buffer after free; test on Phoenix site 280

Browse Source
This commit is contained in:
Jacek Jendrzej
2022-03-26 17:17:14 +01:00
parent 8f45184162
commit 09f067da20
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
lib/libtuxtxt/tuxtxt.cpp
View File

@@ -4816,22 +4816,26 @@ void RenderChar(int Char, tstPageAttr *Attribute, int zoom, int yoffset)
Char = G2table[0][0x20+ Attribute->diacrit];
if ((glyph = FT_Get_Char_Index(face, Char)))
{
if ((error = FTC_SBitCache_Lookup(cache, &typettf, glyph, &sbit_diacrit, NULL)) == 0)
{
sbitbuffer = (unsigned char*) localbuffer;
memmove(sbitbuffer,sbit->buffer,sbit->pitch*sbit->height);
for (Row = 0; Row < sbit->height; Row++)
int height = sbit->height;
int p = sbit->pitch;
if ((error = FTC_SBitCache_Lookup(cache, &typettf, glyph, &sbit_diacrit, NULL)) == 0)
{
for (Pitch = 0; Pitch < sbit->pitch; Pitch++)
for (Row = 0; Row < height; Row++)
{
for (Pitch = 0; Pitch < p; Pitch++)
{
if (sbit_diacrit->pitch > Pitch && sbit_diacrit->height > Row)
if((sbit_diacrit->pitch*sbit_diacrit->height) > (Row*sbit->pitch+Pitch))
sbitbuffer[Row*sbit->pitch+Pitch] |= sbit_diacrit->buffer[Row*sbit->pitch+Pitch];
if((sbit_diacrit->pitch*sbit_diacrit->height) > (Row*p+Pitch))
sbitbuffer[Row*p+Pitch] |= sbit_diacrit->buffer[Row*p+Pitch];
}
}
if ((error = FTC_SBitCache_Lookup(cache, &typettf, glyph, &sbit, NULL)) != 0)
{
return;
}
}
}
}