diff options
| author | Herongguang (Stephen) <herongguang.he@huawei.com> | 2016-07-12 17:31:23 +0800 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2016-07-15 12:11:55 +0200 |
| commit | 3f7e51bca3ef2d64c53b35ab9916c99e4a9e3c69 (patch) | |
| tree | 4dba985541676ba4f1bbe65fc195acbbd26209af /ui/vnc-enc-tight.c | |
| parent | 5a8be0f73d6f60ff08746377eb09ca459f39deab (diff) | |
| download | qemu-3f7e51bca3ef2d64c53b35ab9916c99e4a9e3c69.tar.gz | |
vnc-enc-tight: fix off-by-one bug
In tight_encode_indexed_rect32, buf(or src)’s size is count. In for loop,
the logic is supposed to be that i is an index into src, i should be
incremented when incrementing src.
This is broken when src is incremented but i is not before while loop,
resulting in off-by-one bug in while loop.
Signed-off-by: He Rongguang <herongguang.he@huawei.com>
Message-id: 5784B8EB.7010008@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'ui/vnc-enc-tight.c')
| -rw-r--r-- | ui/vnc-enc-tight.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c index b8581dd2e9..877c09319d 100644 --- a/ui/vnc-enc-tight.c +++ b/ui/vnc-enc-tight.c @@ -461,9 +461,10 @@ static int tight_fill_palette(VncState *vs, int x, int y, \ src = (uint##bpp##_t *) buf; \ \ - for (i = 0; i < count; i++) { \ + for (i = 0; i < count; ) { \ \ rgb = *src++; \ + i++; \ rep = 0; \ while (i < count && *src == rgb) { \ rep++, src++, i++; \ |