From: Michael Schroeder Date: Tue, 6 Sep 2011 07:58:33 +0200 Subject: [PATCH 3/6] VNC: Fix crash when no depth translation is required. Patch-Mainline: Currently no upstream project. Git-commit: 74d5e3115cd955b7ee1acc64c6b8b42198ed894b Signed-off: Egbert Eich References: bnc #389386 Signed-off-by: Egbert Eich --- hw/vnc/translate.c | 11 ++++++----- 1 files changed, 6 insertions(+), 5 deletions(-) diff --git a/hw/vnc/translate.c b/hw/vnc/translate.c index 5cc57a3..78030ed 100644 --- a/hw/vnc/translate.c +++ b/hw/vnc/translate.c @@ -168,17 +168,18 @@ rfbTranslateNone(ScreenPtr pScreen, char *table, rfbPixelFormat *in, rfbPixelFor { VNCSCREENPTR(pScreen); DrawablePtr pDraw = (DrawablePtr)pScreen->root; - int truewidth = PixmapBytePad(width, in->bitsPerPixel) / 4; + int truewidth = PixmapBytePad(width, in->bitsPerPixel); - if ((x + truewidth > pVNC->width) || truewidth != width) { - unsigned char *buffer = malloc(truewidth * height * in->bitsPerPixel / 8); + if ((x + width > pVNC->width) || truewidth != width * in->bitsPerPixel / 8) { + unsigned char *buffer = malloc(truewidth * height); unsigned char *buf = buffer; - (*pScreen->GetImage)(pDraw, x, y, truewidth, height, ZPixmap, ~0, (char*)buf); + (*pScreen->GetImage)(pDraw, x, y, width, height, ZPixmap, ~0, (char*)buf); + while (height--) { memcpy(optr, buf, width * in->bitsPerPixel / 8); optr += width * in->bitsPerPixel / 8; - buf += truewidth * in->bitsPerPixel / 8; + buf += truewidth; } free(buffer); return; -- 1.7.3.4