libvncserver/font.c: add some checks to rfbDrawChar().

In some cases (bad font data) the coordinates evaluate to <0,
causing a segfault in the following memcpy().

[jes: keep the offset, but do not try to segfault]

Signed-off-by: Christian Beier <dontmind@freeshell.org>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
pull/1/head
Christian Beier 15 years ago committed by Johannes Schindelin
parent 6220f13003
commit 07008deea2

@ -24,7 +24,8 @@ int rfbDrawChar(rfbScreenInfoPtr rfbScreen,rfbFontDataPtr font,
d=*data; d=*data;
data++; data++;
} }
if(d&0x80) if(d&0x80 && y+j >= 0 && y+j < rfbScreen->height &&
x+i >= 0 && x+i < rfbScreen->width)
memcpy(rfbScreen->frameBuffer+(y+j)*rowstride+(x+i)*bpp,colour,bpp); memcpy(rfbScreen->frameBuffer+(y+j)*rowstride+(x+i)*bpp,colour,bpp);
d<<=1; d<<=1;
} }

Loading…
Cancel
Save