summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKim Woelders <kim@woelders.dk>2016-04-06 02:35:43 +0200
committerKim Woelders <kim@woelders.dk>2016-04-06 02:36:23 +0200
commitce94edca1ccfbe314cb7cd9453433fad404ec7ef (patch)
tree80b38565f8057e7e6ef72da984851968873d163e
parent16de244bd03d2f75da6508feb1ad9cb4e668e9dc (diff)
Fix off-by-one OOB read in __imlib_MergeUpdate().
Patch by Yuriy M. Kaminskiy. https://bugs.debian.org/819818
-rw-r--r--src/lib/updates.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/lib/updates.c b/src/lib/updates.c
index 8167284..2f55fe7 100644
--- a/src/lib/updates.c
+++ b/src/lib/updates.c
@@ -112,7 +112,7 @@ __imlib_MergeUpdate(ImlibUpdate * u, int w, int h, int hgapmax)
112 int xx, yy, ww, hh, ok, xww; 112 int xx, yy, ww, hh, ok, xww;
113 113
114 for (xx = x + 1, ww = 1; 114 for (xx = x + 1, ww = 1;
115 (T(xx, y).used & T_USED) && (xx < tw); xx++, ww++); 115 (xx < tw) && (T(xx, y).used & T_USED); xx++, ww++);
116 xww = x + ww; 116 xww = x + ww;
117 for (yy = y + 1, hh = 1, ok = 1; 117 for (yy = y + 1, hh = 1, ok = 1;
118 (yy < th) && (ok); yy++, hh++) 118 (yy < th) && (ok); yy++, hh++)