[tfaber] 74382: [VGADDI] - Fix buffer overflow in DIB_BltFromVGA. A byte fits two pixels.

Author: tfaber
Date: Thu Apr 20 07:30:01 2017
New Revision: 74382

URL: http://svn.reactos.org/svn/reactos?rev=74382&view=rev
Log:
[VGADDI]
- Fix buffer overflow in DIB_BltFromVGA. A byte fits two pixels.

Modified:
    trunk/reactos/win32ss/drivers/displays/vga/vgavideo/vgavideo.c

Modified: trunk/reactos/win32ss/drivers/displays/vga/vgavideo/vgavideo.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/drivers/displays/vg...
==============================================================================
--- trunk/reactos/win32ss/drivers/displays/vga/vgavideo/vgavideo.c	[iso-8859-1] (original)
+++ trunk/reactos/win32ss/drivers/displays/vga/vgavideo/vgavideo.c	[iso-8859-1] Thu Apr 20 07:30:01 2017
@@ -369,6 +369,7 @@
         stride = 0;
         rightcount = w;
     }
+    rightcount = (rightcount + 1) / 2;

/* Reset the destination. */
     for (j = 0; j < h; j++)
@@ -414,7 +415,7 @@

row = UnpackPixel[pixel] << plane;

-                /* Store the data for each pixel in the destination. */
+                /* Store the data for each byte in the destination. */
                 for (i = 0; i < rightcount; i++)
                 {
                     ((PUCHAR)destline)[i] |= (row & 0xFF);