[Gnash-commit] gnash ChangeLog server/parser/shape_character_d...

[Benjamin Wolsey]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Benjamin Wolsey <bwy>   08/02/12 09:38:37

Modified files:
        .              : ChangeLog 
        server/parser  : shape_character_def.cpp 

Log message:
        Checks I missed last time.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.5617&r2=1.5618
http://cvs.savannah.gnu.org/viewcvs/gnash/server/parser/shape_character_def.cpp?cvsroot=gnash&r1=1.64&r2=1.65

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.5617
retrieving revision 1.5618
diff -u -b -r1.5617 -r1.5618
--- ChangeLog   12 Feb 2008 08:49:24 -0000      1.5617
+++ ChangeLog   12 Feb 2008 09:38:36 -0000      1.5618
@@ -1,5 +1,10 @@
 2008-02-12 Benjamin Wolsey <address@hidden>
 
+       * server/parser/shape_character_def.cpp: add some checks I missed last
+         time.
+
+2008-02-12 Benjamin Wolsey <address@hidden>
+
        * server/parser/shape_character_def.cpp: add ensureBytes/Bits checking
          to fix assertion failures with malformed SWFs. Fixes bug #22288.
 

Index: server/parser/shape_character_def.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/parser/shape_character_def.cpp,v
retrieving revision 1.64
retrieving revision 1.65
diff -u -b -r1.64 -r1.65
--- server/parser/shape_character_def.cpp       12 Feb 2008 08:49:25 -0000      
1.64
+++ server/parser/shape_character_def.cpp       12 Feb 2008 09:38:37 -0000      
1.65
@@ -17,7 +17,7 @@
 // Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 //
 
-/* $Id: shape_character_def.cpp,v 1.64 2008/02/12 08:49:25 bwy Exp $ */
+/* $Id: shape_character_def.cpp,v 1.65 2008/02/12 09:38:37 bwy Exp $ */
 
 // Based on the public domain shape.cpp of Thatcher Ulrich <address@hidden> 
2003
 
@@ -194,6 +194,7 @@
   {
     rect tbound;
     tbound.read(in);
+    in->ensureBytes(1);
     /*boost::uint8_t scales =*/static_cast<void>(in->read_u8());
     static bool warned = false;
     if ( ! warned )
@@ -301,6 +302,7 @@
     }
     in->ensureBits(5);
     int num_move_bits = in->read_uint(5);
+    in->ensureBits(2 * num_move_bits);
     int move_x = in->read_sint(num_move_bits);
     int move_y = in->read_sint(num_move_bits);
 
@@ -508,9 +510,8 @@
     y = ay;
       } else {
     // straight edge
-    in->ensureBits(4);
+    in->ensureBits(5);
     int num_bits = 2 + in->read_uint(4);
-    in->ensureBits(1);
     bool  line_flag = in->read_bit();
     int dx = 0, dy = 0;
     if (line_flag) {