[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Gnash-commit] gnash ChangeLog server/parser/shape_character_d...
From: |
Benjamin Wolsey |
Subject: |
[Gnash-commit] gnash ChangeLog server/parser/shape_character_d... |
Date: |
Tue, 12 Feb 2008 09:38:37 +0000 |
CVSROOT: /sources/gnash
Module name: gnash
Changes by: Benjamin Wolsey <bwy> 08/02/12 09:38:37
Modified files:
. : ChangeLog
server/parser : shape_character_def.cpp
Log message:
Checks I missed last time.
CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.5617&r2=1.5618
http://cvs.savannah.gnu.org/viewcvs/gnash/server/parser/shape_character_def.cpp?cvsroot=gnash&r1=1.64&r2=1.65
Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.5617
retrieving revision 1.5618
diff -u -b -r1.5617 -r1.5618
--- ChangeLog 12 Feb 2008 08:49:24 -0000 1.5617
+++ ChangeLog 12 Feb 2008 09:38:36 -0000 1.5618
@@ -1,5 +1,10 @@
2008-02-12 Benjamin Wolsey <address@hidden>
+ * server/parser/shape_character_def.cpp: add some checks I missed last
+ time.
+
+2008-02-12 Benjamin Wolsey <address@hidden>
+
* server/parser/shape_character_def.cpp: add ensureBytes/Bits checking
to fix assertion failures with malformed SWFs. Fixes bug #22288.
Index: server/parser/shape_character_def.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/parser/shape_character_def.cpp,v
retrieving revision 1.64
retrieving revision 1.65
diff -u -b -r1.64 -r1.65
--- server/parser/shape_character_def.cpp 12 Feb 2008 08:49:25 -0000
1.64
+++ server/parser/shape_character_def.cpp 12 Feb 2008 09:38:37 -0000
1.65
@@ -17,7 +17,7 @@
// Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
//
-/* $Id: shape_character_def.cpp,v 1.64 2008/02/12 08:49:25 bwy Exp $ */
+/* $Id: shape_character_def.cpp,v 1.65 2008/02/12 09:38:37 bwy Exp $ */
// Based on the public domain shape.cpp of Thatcher Ulrich <address@hidden>
2003
@@ -194,6 +194,7 @@
{
rect tbound;
tbound.read(in);
+ in->ensureBytes(1);
/*boost::uint8_t scales =*/static_cast<void>(in->read_u8());
static bool warned = false;
if ( ! warned )
@@ -301,6 +302,7 @@
}
in->ensureBits(5);
int num_move_bits = in->read_uint(5);
+ in->ensureBits(2 * num_move_bits);
int move_x = in->read_sint(num_move_bits);
int move_y = in->read_sint(num_move_bits);
@@ -508,9 +510,8 @@
y = ay;
} else {
// straight edge
- in->ensureBits(4);
+ in->ensureBits(5);
int num_bits = 2 + in->read_uint(4);
- in->ensureBits(1);
bool line_flag = in->read_bit();
int dx = 0, dy = 0;
if (line_flag) {