Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 159958 - out-of-bounds write in DrawToImage. r=pedemonte, sr=brendan

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@156258 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
tor%cs.brown.edu 2004-05-11 20:57:26 +00:00
parent 3fc3836cee
commit 7ccbe49e94
3 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
mozilla/gfx/src/gtk/nsImageGTK.cpp
View File

@ -2009,9 +2009,9 @@ NS_IMETHODIMP nsImageGTK::DrawToImage(nsIImage* aDstImage,
else {
dstAlpha[(aDX+x)>>3] |= alphaPixels >> offset;
// avoid write if no 1's to write - also avoids going past end of array
// compiler should merge the common sub-expressions
if (alphaPixels << (8U - offset))
dstAlpha[((aDX+x)>>3) + 1] |= alphaPixels << (8U - offset);
PRUint8 alphaTemp = alphaPixels << (8U - offset);
if (alphaTemp & 0xff)
dstAlpha[((aDX+x)>>3) + 1] |= alphaTemp;
}
if (alphaPixels == 0xff) {

6
mozilla/gfx/src/windows/nsImageWin.cpp
View File

@ -1883,9 +1883,9 @@ NS_IMETHODIMP nsImageWin::DrawToImage(nsIImage* aDstImage, nscoord aDX, nscoord
} else {
dstAlpha[(aDX+x)>>3] |= alphaPixels >> offset;
// avoid write if no 1's to write - also avoids going past end of array
// compiler should merge the common sub-expressions
if (alphaPixels << (8U - offset))
dstAlpha[((aDX+x)>>3) + 1] |= alphaPixels << (8U - offset);
PRUint8 alphaTemp = alphaPixels << (8U - offset);
if (alphaTemp & 0xff)
dstAlpha[((aDX+x)>>3) + 1] |= alphaTemp;
}

6
mozilla/gfx/src/xlib/nsImageXlib.cpp
View File

@ -1602,9 +1602,9 @@ NS_IMETHODIMP nsImageXlib::DrawToImage(nsIImage* aDstImage,
else {
dstAlpha[(aDX+x)>>3] |= alphaPixels >> offset;
// avoid write if no 1's to write - also avoids going past end of array
// compiler should merge the common sub-expressions
if (alphaPixels << (8U - offset))
dstAlpha[((aDX+x)>>3) + 1] |= alphaPixels << (8U - offset);
PRUint8 alphaTemp = alphaPixels << (8U - offset);
if (alphaTemp & 0xff)
dstAlpha[((aDX+x)>>3) + 1] |= alphaTemp;
}
if (alphaPixels == 0xff) {