From: Herongguang (Stephen) <herongguang.he@huawei.com>
Date: Tue, 12 Jul 2016 09:31:23 +0000 (+0800)
Subject: vnc-enc-tight: fix off-by-one bug
X-Git-Tag: v2.6.2~4
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=98b81297bfa7a1a7acfd8689f7c6447cbc128bfa;p=thirdparty%2Fqemu.git

vnc-enc-tight: fix off-by-one bug

In tight_encode_indexed_rect32, buf(or src)’s size is count. In for loop,
the logic is supposed to be that i is an index into src, i should be
incremented when incrementing src.

This is broken when src is incremented but i is not before while loop,
resulting in off-by-one bug in while loop.

Signed-off-by: He Rongguang <herongguang.he@huawei.com>
Message-id: 5784B8EB.7010008@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 3f7e51bca3ef2d64c53b35ab9916c99e4a9e3c69)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---

diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c
index e5cba0e5a73..678c5dfbaaa 100644
--- a/ui/vnc-enc-tight.c
+++ b/ui/vnc-enc-tight.c
@@ -461,9 +461,10 @@ static int tight_fill_palette(VncState *vs, int x, int y,
                                                                         \
         src = (uint##bpp##_t *) buf;                                    \
                                                                         \
-        for (i = 0; i < count; i++) {                                   \
+        for (i = 0; i < count; ) {                                      \
                                                                         \
             rgb = *src++;                                               \
+            i++;                                                        \
             rep = 0;                                                    \
             while (i < count && *src == rgb) {                          \
                 rep++, src++, i++;                                      \