jh163888/xrdp
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix crash with large cursors

Browse Source
This commit is contained in:
jsorg71 2005-03-28 00:43:17 +00:00
parent 959be9d2a2
commit e61e379a92
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
vnc/vnc.c
View File

@ -513,7 +513,6 @@ int lib_framebuffer_update(struct vnc* v)
data_size = need_size; data_size = need_size;
} }
error = lib_recv(v, data, need_size); error = lib_recv(v, data, need_size);
/*g_printf("%d %d\n", i, need_size);*/
if (error == 0) if (error == 0)
{ {
error = v->server_paint_rect(v, x, y, cx, cy, data); error = v->server_paint_rect(v, x, y, cx, cy, data);
@ -534,12 +533,14 @@ int lib_framebuffer_update(struct vnc* v)
{ {
g_memset(cursor_data, 0, 32 * (32 * 3)); g_memset(cursor_data, 0, 32 * (32 * 3));
g_memset(cursor_mask, 0, 32 * (32 / 8)); g_memset(cursor_mask, 0, 32 * (32 / 8));
init_stream(s, 8192); j = cx * cy * Bpp;
error = lib_recv(v, s->data, cx * cy * Bpp + ((cx + 7) / 8) * cy); k = ((cx + 7) / 8) * cy;
init_stream(s, j + k);
error = lib_recv(v, s->data, j + k);
if (error == 0) if (error == 0)
{ {
in_uint8p(s, d1, cx * cy * Bpp); in_uint8p(s, d1, j);
in_uint8p(s, d2, ((cx + 7) / 8) * cy); in_uint8p(s, d2, k);
for (j = 0; j < 32; j++) for (j = 0; j < 32; j++)
{ {
for (k = 0; k < 32; k++) for (k = 0; k < 32; k++)