[gdk-pixbuf] gdk-pixbuf-xlib: Fix out-of-bounds error on big endian



commit 09ddf12378f34179c3e5c0e8db869f975a8ea139
Author: Max Staudt <mstaudt suse de>
Date:   Fri Dec 9 17:01:00 2016 +0000

    gdk-pixbuf-xlib: Fix out-of-bounds error on big endian
    
    On Little Endian, the code writes memory out of bounds (i.e. when
    running inside a little endian client, connecting to a big endian X
    server).
    
    On Big Endian, it only processes the first 1/4 of an icon.
    
    The effects can be seen when running IceWM. Running native on Big Endian
    ppc64 with a Big Endian X11 server, the icon background was 3/4 random:
    
    See https://bugzilla.suse.com/show_bug.cgi?id=929462
    
    Make rgb888amsb() behave similarly to rgb888msb() to fix this problem.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=775896

 contrib/gdk-pixbuf-xlib/gdk-pixbuf-xlib-drawable.c |   15 ---------------
 1 files changed, 0 insertions(+), 15 deletions(-)
---
diff --git a/contrib/gdk-pixbuf-xlib/gdk-pixbuf-xlib-drawable.c 
b/contrib/gdk-pixbuf-xlib/gdk-pixbuf-xlib-drawable.c
index 972c2be..422fdc8 100644
--- a/contrib/gdk-pixbuf-xlib/gdk-pixbuf-xlib-drawable.c
+++ b/contrib/gdk-pixbuf-xlib/gdk-pixbuf-xlib-drawable.c
@@ -915,13 +915,8 @@ rgb888amsb (XImage *image, guchar *pixels, int rowstride, xlib_colormap *colorma
        int bpl;
 
        guint8 *srow = (guint8 *)image->data, *orow = pixels;
-#ifdef LITTLE
-       guint32 *o;
-       guint32 *s;
-#else
        guint8 *s;      /* for byte order swapping */
        guint8 *o;
-#endif
 
        d (printf ("32 bit, msb, with alpha\n"));
 
@@ -931,24 +926,14 @@ rgb888amsb (XImage *image, guchar *pixels, int rowstride, xlib_colormap *colorma
 
        /* msb data */
        for (yy = 0; yy < height; yy++) {
-#ifdef LITTLE
-               s = (guint32 *) srow;
-               o = (guint32 *) orow;
-#else
                s = srow;
                o = orow;
-#endif
                for (xx = 0; xx < width; xx++) {
-#ifdef LITTLE
                        *o++ = s[1];
                        *o++ = s[2];
                        *o++ = s[3];
                        *o++ = 0xff;
                        s += 4;
-#else
-                       *o++ = (*s << 8) | 0xff; /* untested */
-                       s++;
-#endif
                }
                srow += bpl;
                orow += rowstride;


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]