Author: tfaber
Date: Thu Apr 20 07:30:01 2017
New Revision: 74382
URL:
http://svn.reactos.org/svn/reactos?rev=74382&view=rev
Log:
[VGADDI]
- Fix buffer overflow in DIB_BltFromVGA. A byte fits two pixels.
Modified:
trunk/reactos/win32ss/drivers/displays/vga/vgavideo/vgavideo.c
Modified: trunk/reactos/win32ss/drivers/displays/vga/vgavideo/vgavideo.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/win32ss/drivers/displays/v…
==============================================================================
--- trunk/reactos/win32ss/drivers/displays/vga/vgavideo/vgavideo.c [iso-8859-1]
(original)
+++ trunk/reactos/win32ss/drivers/displays/vga/vgavideo/vgavideo.c [iso-8859-1] Thu Apr 20
07:30:01 2017
@@ -369,6 +369,7 @@
stride = 0;
rightcount = w;
}
+ rightcount = (rightcount + 1) / 2;
/* Reset the destination. */
for (j = 0; j < h; j++)
@@ -414,7 +415,7 @@
row = UnpackPixel[pixel] << plane;
- /* Store the data for each pixel in the destination. */
+ /* Store the data for each byte in the destination. */
for (i = 0; i < rightcount; i++)
{
((PUCHAR)destline)[i] |= (row & 0xFF);