[Qemu-devel] [PATCH] vnc-enc-tight: fix off-by-one bug

[Qemu-devel] [PATCH] vnc-enc-tight: fix off-by-one bug

[Herongguang (Stephen)]

In tight_encode_indexed_rect32, buf(or src)’s size is count. In for loop,
the logic is supposed to be that i is an index into src, i should be
incremented when incrementing src.

This is broken when src is incremented but i is not before while loop,
resulting in off-by-one bug in while loop.

Signed-off-by: He Rongguang <herongguang.he@huawei.com>
---
  ui/vnc-enc-tight.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c
index e5cba0e..678c5df 100644
--- a/ui/vnc-enc-tight.c
+++ b/ui/vnc-enc-tight.c
@@ -461,9 +461,10 @@ static int tight_fill_palette(VncState *vs, int x, int y,
                                                                          \
          src = (uint##bpp##_t *) buf;                                    \
                                                                          \
-        for (i = 0; i < count; i++) {                                   \
+        for (i = 0; i < count; ) {                                      \
                                                                          \
              rgb = *src++;                                               \
+            i++;                                                        \
              rep = 0;                                                    \
              while (i < count && *src == rgb) {                          \
                  rep++, src++, i++;                                      \
-- 
1.8.3.4

Re: [Qemu-devel] [PATCH] vnc-enc-tight: fix off-by-one bug

[Gerd Hoffmann]

On Di, 2016-07-12 at 17:31 +0800, Herongguang (Stephen) wrote:
> In tight_encode_indexed_rect32, buf(or src)’s size is count. In for loop,
> the logic is supposed to be that i is an index into src, i should be
> incremented when incrementing src.
> 
> This is broken when src is incremented but i is not before while loop,
> resulting in off-by-one bug in while loop.
> 
> Signed-off-by: He Rongguang <herongguang.he@huawei.com>

Added to vnc queue.

Patch is whitespace mangled, had to use "patch --ignore-whitespace" to
get it applied.  Can you please use 'git send-email' to send patches in
the future?  That is the best way to avoid your mail client breaking
patches.

thanks,
  Gerd