Commit 3f7e51bc authored Jul 12, 2016 by Herongguang (Stephen) Committed by Gerd Hoffmann Jul 15, 2016

vnc-enc-tight: fix off-by-one bug



In tight_encode_indexed_rect32, buf(or src)’s size is count. In for loop,
the logic is supposed to be that i is an index into src, i should be
incremented when incrementing src.

This is broken when src is incremented but i is not before while loop,
resulting in off-by-one bug in while loop.

Signed-off-by: He Rongguang <herongguang.he@huawei.com>
Message-id: 5784B8EB.7010008@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

parent 5a8be0f7

ui/vnc-enc-tight.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -461,9 +461,10 @@ static int tight_fill_palette(VncState *vs, int x, int y,
		\
		src = (uint##bpp##_t *) buf; \
		\
		for (i = 0; i < count; i++) { \
		for (i = 0; i < count; ) { \
		\
		rgb = *src++; \
		i++; \
		rep = 0; \
		while (i < count && *src == rgb) { \
		rep++, src++, i++; \