Hi,
the attached patch fixes crashing oosplash and malformed picture.
The first line fixes accessing aliased out buffer, see
https://bugzilla.novell.com/show_bug.cgi?id=652562#c22
The second line fixes broken if/if/else condition to do not bump the out
pointer twice, see
https://bugzilla.novell.com/show_bug.cgi?id=652562#c16
It might be worth to add it into libreoffice-3-3-1 branch.
We already have confirmation from the reporter for the second line. I
was able to reproduce the 1st line problem here and the fix helped.
Could you please review it?
Best Regards,
Petr
--- desktop/unx/source/splashx.c.old 2010-11-11 16:30:07.000000000 +0100
+++ desktop/unx/source/splashx.c 2011-02-11 21:46:52.000000000 +0100
@@ -333,6 +333,7 @@ static void create_pixmap()
int x, y; \
for ( y = 0; y < height; ++y ) \
{ \
+ out = data + y * bytes_per_line; \
unsigned long red_delta = 0, green_delta = 0, blue_delta = 0; \
color_t *in = (color_t *)bitmap_rows[y]; \
for ( x = 0; x < width; ++x, ++in ) \
@@ -376,7 +376,7 @@ static void create_pixmap()
{
if ( machine_byte_order == byte_order && byte_order == LSBFirst )
COPY_IN_OUT( 3, *( (color_t *)out ) = *( (color_t *)( &pixel ) ); out += 3; )
- if ( machine_byte_order == byte_order && byte_order == MSBFirst )
+ else if ( machine_byte_order == byte_order && byte_order == MSBFirst )
COPY_IN_OUT( 3, uint32_t tmp = pixel;
*( (uint8_t *)out ) = *( (uint8_t *)(&tmp) + 1 );
*( (uint8_t *)out + 1 ) = *( (uint8_t *)(&tmp) + 2 );
_______________________________________________
LibreOffice mailing list
LibreOffice@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice
