mirrors/recycled-ni-neutrino
1
0
Fork 0
mirror of https://github.com/tuxbox-fork-migrations/recycled-ni-neutrino.git synced 2025-08-27 15:32:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

tuxtxt: try to fix use sbit->buffer after free; test on Phoenix site 280

Browse Source 
Origin commit data
------------------
Commit: 8489d8a8d1
Author: Jacek Jendrzej <overx300@gmail.com>
Date: 2022-03-27 (Sun, 27 Mar 2022)
This commit is contained in:
Jacek Jendrzej
2022-03-27 21:46:44 +02:00
committed by vanhofen
parent ffc2058b18
commit a49bf4d436
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
lib/libtuxtxt/tuxtxt.cpp
View File

@@ -4812,22 +4812,26 @@ void RenderChar(int Char, tstPageAttr *Attribute, int zoom, int yoffset)
Char = G2table[0][0x20+ Attribute->diacrit]; Char = G2table[0][0x20+ Attribute->diacrit];
if ((glyph = FT_Get_Char_Index(face, Char))) if ((glyph = FT_Get_Char_Index(face, Char)))
{
if ((error = FTC_SBitCache_Lookup(cache, &typettf, glyph, &sbit_diacrit, NULL)) == 0)
{ {
sbitbuffer = (unsigned char*) localbuffer; sbitbuffer = (unsigned char*) localbuffer;
memmove(sbitbuffer,sbit->buffer,sbit->pitch*sbit->height); memmove(sbitbuffer,sbit->buffer,sbit->pitch*sbit->height);
int height = sbit->height;
for (Row = 0; Row < sbit->height; Row++) int p = sbit->pitch;
if ((error = FTC_SBitCache_Lookup(cache, &typettf, glyph, &sbit_diacrit, NULL)) == 0)
{ {
for (Pitch = 0; Pitch < sbit->pitch; Pitch++) for (Row = 0; Row < height; Row++)
{
for (Pitch = 0; Pitch < p; Pitch++)
{ {
if (sbit_diacrit->pitch > Pitch && sbit_diacrit->height > Row) if (sbit_diacrit->pitch > Pitch && sbit_diacrit->height > Row)
if((sbit_diacrit->pitch*sbit_diacrit->height) > (Row*sbit->pitch+Pitch)) if((sbit_diacrit->pitch*sbit_diacrit->height) > (Row*p+Pitch))
sbitbuffer[Row*sbit->pitch+Pitch] |= sbit_diacrit->buffer[Row*sbit->pitch+Pitch]; sbitbuffer[Row*p+Pitch] |= sbit_diacrit->buffer[Row*p+Pitch];
} }
} }
if ((error = FTC_SBitCache_Lookup(cache, &typettf, glyph, &sbit, NULL)) != 0)
{
return;
}
} }
} }
} }