From 30751c6025828b865afce1aa057376348cf3ec5d Mon Sep 17 00:00:00 2001 From: albeu Date: Mon, 18 Nov 2002 20:43:29 +0000 Subject: Fix buffer overflow in a drawing func git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@8233 b3059339-0415-0410-9bf9-f77b7e298cf2 --- libmenu/menu.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) (limited to 'libmenu') diff --git a/libmenu/menu.c b/libmenu/menu.c index f7eadcf38a..d807b0ee03 100644 --- a/libmenu/menu.c +++ b/libmenu/menu.c @@ -357,7 +357,7 @@ void menu_draw_text_full(mp_image_t* mpi,char* txt, if(align & MENU_TEXT_VCENTER) sy = ymin + ((h - need_h)/2); else if(align & MENU_TEXT_BOT) - sy = ymax - need_h; + sy = ymax - need_h - 1; else sy = y; @@ -443,7 +443,7 @@ void menu_draw_text_full(mp_image_t* mpi,char* txt, if(align & MENU_TEXT_HCENTER) sx = xmid - ll/2; else - sx = xmax - ll; + sx = xmax - 1 - ll; } } else { for(sx = xrmin ; sx < xmin && txt != line_end ; txt++) { @@ -455,15 +455,20 @@ void menu_draw_text_full(mp_image_t* mpi,char* txt, while(sx < xmax && txt != line_end) { unsigned char c = *txt++; font = vo_font->font[c]; - if ( (font >= 0) && (sx + vo_font->width[c] <= xmax) /*&& (sy + vo_font->pic_a[font]->h <= ymax)*/) - draw_alpha(vo_font->width[c], vo_font->pic_a[font]->h, - vo_font->pic_b[font]->bmp+vo_font->start[c], - vo_font->pic_a[font]->bmp+vo_font->start[c], - vo_font->pic_a[font]->w, - mpi->planes[0] + sy * mpi->stride[0] + sx * (mpi->bpp>>3), - mpi->stride[0]); -/* else */ -/* printf("Can't draw '%c'\n",c); */ + if(font >= 0) { + int cs = (vo_font->pic_a[font]->h - vo_font->height) / 2; + if ((sx + vo_font->width[c] < xmax) && (sy + vo_font->height < ymax) ) + draw_alpha(vo_font->width[c], vo_font->height, + vo_font->pic_b[font]->bmp+vo_font->start[c] + + cs * vo_font->pic_a[font]->w, + vo_font->pic_a[font]->bmp+vo_font->start[c] + + cs * vo_font->pic_a[font]->w, + vo_font->pic_a[font]->w, + mpi->planes[0] + sy * mpi->stride[0] + sx * (mpi->bpp>>3), + mpi->stride[0]); + // else + //printf("Can't draw '%c'\n",c); + } sx+=vo_font->width[c]+vo_font->charspace; } txt = line_end; -- cgit v1.2.3