From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56368) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bMu5B-0000sM-Rm for qemu-devel@nongnu.org; Tue, 12 Jul 2016 05:34:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bMu56-0000vH-22 for qemu-devel@nongnu.org; Tue, 12 Jul 2016 05:34:24 -0400 Received: from szxga03-in.huawei.com ([119.145.14.66]:28944) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bMu55-0000s3-9B for qemu-devel@nongnu.org; Tue, 12 Jul 2016 05:34:19 -0400 From: "Herongguang (Stephen)" Message-ID: <5784B8EB.7010008@huawei.com> Date: Tue, 12 Jul 2016 17:31:23 +0800 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PATCH] vnc-enc-tight: fix off-by-one bug List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org, kraxel@redhat.com, pbonzini@redhat.com, herongguang.he@huawei.com, weidong.huang@huawei.com, "peter.huangpeng@huawei.com >> Huangpeng (Peter)" In tight_encode_indexed_rect32, buf(or src)’s size is count. In for loop, the logic is supposed to be that i is an index into src, i should be incremented when incrementing src. This is broken when src is incremented but i is not before while loop, resulting in off-by-one bug in while loop. Signed-off-by: He Rongguang --- ui/vnc-enc-tight.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c index e5cba0e..678c5df 100644 --- a/ui/vnc-enc-tight.c +++ b/ui/vnc-enc-tight.c @@ -461,9 +461,10 @@ static int tight_fill_palette(VncState *vs, int x, int y, \ src = (uint##bpp##_t *) buf; \ \ - for (i = 0; i < count; i++) { \ + for (i = 0; i < count; ) { \ \ rgb = *src++; \ + i++; \ rep = 0; \ while (i < count && *src == rgb) { \ rep++, src++, i++; \ -- 1.8.3.4