CVSROOT: /sources/gnash
Module name: gnash
Changes by: Sandro Santilli <strk> 07/12/06 00:32:54
Modified files:
. : ChangeLog
server/parser : shape_character_def.cpp
Log message:
don't consume an additional byte if both fill and line bits are zero.
CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.5093&r2=1.5094
http://cvs.savannah.gnu.org/viewcvs/gnash/server/parser/shape_character_def.cpp?cvsroot=gnash&r1=1.56&r2=1.57
Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.5093
retrieving revision 1.5094
diff -u -b -r1.5093 -r1.5094
--- ChangeLog 5 Dec 2007 16:06:46 -0000 1.5093
+++ ChangeLog 6 Dec 2007 00:32:54 -0000 1.5094
@@ -1,3 +1,10 @@
+2007-12-06 Sandro Santilli <[EMAIL PROTECTED]>
+
+ * server/parser/shape_character_def.cpp (read): don't
+ consume an additional byte if both fill and line bits
+ are zero. Fixes an out-of-bound access during Glyph
+ parsing of bgtest.swf (1a2bd0411b38db40e74916a3b413522c)
+
2007-12-05 Sandro Santilli <[EMAIL PROTECTED]>
* testsuite/server/StreamTest.cpp: don't assume
Index: server/parser/shape_character_def.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/parser/shape_character_def.cpp,v
retrieving revision 1.56
retrieving revision 1.57
diff -u -b -r1.56 -r1.57
--- server/parser/shape_character_def.cpp 5 Dec 2007 08:24:36 -0000
1.56
+++ server/parser/shape_character_def.cpp 6 Dec 2007 00:32:54 -0000
1.57
@@ -17,7 +17,7 @@
// Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
//
-/* $Id: shape_character_def.cpp,v 1.56 2007/12/05 08:24:36 strk Exp $ */
+/* $Id: shape_character_def.cpp,v 1.57 2007/12/06 00:32:54 strk Exp $ */
// Based on the public domain shape.cpp of Thatcher Ulrich <[EMAIL PROTECTED]>
2003
@@ -225,6 +225,11 @@
log_parse(_(" shape_character_def read: nfillbits = %d, nlinebits = %d"),
num_fill_bits, num_line_bits);
);
+ if ( !num_fill_bits && !num_line_bits )
+ {
+ return;
+ }
+
// These are state variables that keep the
// current position & style of the shape
// outline, and vary as we read the edge data.
_______________________________________________
Gnash-commit mailing list
[email protected]
http://lists.gnu.org/mailman/listinfo/gnash-commit
