mirrors/recycled-ni-neutrino
1
0
Fork 0
mirror of https://github.com/tuxbox-fork-migrations/recycled-ni-neutrino.git synced 2025-08-27 07:22:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

tuxtxt: try to fix use sbit->buffer after free; test on Phoenix site 280

Browse Source 
Origin commit data
------------------
Commit: 8489d8a8d1
Author: Jacek Jendrzej <overx300@gmail.com>
Date: 2022-03-27 (Sun, 27 Mar 2022)
This commit is contained in:
Jacek Jendrzej
2022-03-27 21:46:44 +02:00
committed by vanhofen
parent ffc2058b18
commit a49bf4d436
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
lib/libtuxtxt/tuxtxt.cpp
View File

@@ -4813,21 +4813,25 @@ void RenderChar(int Char, tstPageAttr *Attribute, int zoom, int yoffset)
if ((glyph = FT_Get_Char_Index(face, Char)))
{
sbitbuffer = (unsigned char*) localbuffer;
memmove(sbitbuffer,sbit->buffer,sbit->pitch*sbit->height);
int height = sbit->height;
int p = sbit->pitch;
if ((error = FTC_SBitCache_Lookup(cache, &typettf, glyph, &sbit_diacrit, NULL)) == 0)
{
sbitbuffer = (unsigned char*) localbuffer;
memmove(sbitbuffer,sbit->buffer,sbit->pitch*sbit->height);
for (Row = 0; Row < sbit->height; Row++)
for (Row = 0; Row < height; Row++)
{
for (Pitch = 0; Pitch < sbit->pitch; Pitch++)
for (Pitch = 0; Pitch < p; Pitch++)
{
if (sbit_diacrit->pitch > Pitch && sbit_diacrit->height > Row)
if((sbit_diacrit->pitch*sbit_diacrit->height) > (Row*sbit->pitch+Pitch))
sbitbuffer[Row*sbit->pitch+Pitch] |= sbit_diacrit->buffer[Row*sbit->pitch+Pitch];
if((sbit_diacrit->pitch*sbit_diacrit->height) > (Row*p+Pitch))
sbitbuffer[Row*p+Pitch] |= sbit_diacrit->buffer[Row*p+Pitch];
}
}
if ((error = FTC_SBitCache_Lookup(cache, &typettf, glyph, &sbit, NULL)) != 0)
{
return;
}
}
}
}