[vlc-commits] fix gui/skins2: ft2_bitmap.cpp write after allocated block

[ripper]

vlc | branch: master | ripper <ripper-tm at localhost> | Sat Dec 14 23:09:59 2013 +0400| [53461387eed619db3839895e5f52c75f404de9cf] | committer: Erwan Tulou

fix gui/skins2: ft2_bitmap.cpp write after allocated block

this fixes trac #10134

Signed-off-by: Erwan Tulou <erwan10 at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=53461387eed619db3839895e5f52c75f404de9cf
---

 modules/gui/skins2/src/ft2_bitmap.cpp |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/gui/skins2/src/ft2_bitmap.cpp b/modules/gui/skins2/src/ft2_bitmap.cpp
index e743755..fed481b 100644
--- a/modules/gui/skins2/src/ft2_bitmap.cpp
+++ b/modules/gui/skins2/src/ft2_bitmap.cpp
@@ -50,10 +50,10 @@ void FT2Bitmap::draw( const FT_Bitmap &rBitmap, int left, int top,
     uint8_t green = (color >> 8) & 0xff;
     uint8_t red = (color >> 16) & 0xff;
 
-    for( int y = top; y < top + rBitmap.rows; y++ )
+    for( int y = top; y < top + rBitmap.rows && y < m_height; y++ )
     {
         uint8_t *pData = m_pData + 4 * (m_width * y + left);
-        for( int x = left; x < left + rBitmap.width; x++ )
+        for( int x = left; x < left + rBitmap.width && x < m_width; x++ )
         {
             // The buffer in FT_Bitmap contains alpha values
             uint8_t val = *(pBuf++);