CVS: rdesktop xwin.c,1.196,1.197

Update of /cvsroot/rdesktop/rdesktop
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv14840

Modified Files:
	xwin.c 
Log Message:
Handle too short 0xff and 0xfe commands in ui_draw_text. 

This fix should remove both a segfault and a "this shouldn't be
happening" abortion, which I can trigger with vertical text in
OpenOffice 2.0.


Index: xwin.c
===================================================================
RCS file: /cvsroot/rdesktop/rdesktop/xwin.c,v
retrieving revision 1.196
retrieving revision 1.197
diff -C2 -d -r1.196 -r1.197
*** xwin.c	29 Sep 2005 03:34:33 -0000	1.196
--- xwin.c	18 Nov 2005 22:46:38 -0000	1.197
***************
*** 2446,2463 ****
  		{
  			case 0xff:
! 				if (i + 2 < length)
! 					cache_put_text(text[i + 1], text, text[i + 2]);
! 				else
  				{
! 					error("this shouldn't be happening\n");
! 					exit(1);
  				}
  				/* this will move pointer from start to first character after FF command */
! 				length -= i + 3;
! 				text = &(text[i + 3]);
  				i = 0;
  				break;
  
  			case 0xfe:
  				entry = cache_get_text(text[i + 1]);
  				if (entry != NULL)
--- 2446,2470 ----
  		{
  			case 0xff:
! 				if (i + 3 > length)
  				{
! 					/* short command, skip */
! 					i = length = 0;
! 					break;
  				}
+ 				cache_put_text(text[i + 1], text, text[i + 2]);
+ 				i += 3;
+ 				length -= i;
  				/* this will move pointer from start to first character after FF command */
! 				text = &(text[i]);
  				i = 0;
  				break;
  
  			case 0xfe:
+ 				if (i + 3 > length)
+ 				{
+ 					/* short command, skip */
+ 					i = length = 0;
+ 					break;
+ 				}
  				entry = cache_get_text(text[i + 1]);
  				if (entry != NULL)
***************
*** 2474,2481 ****
  						DO_GLYPH(((uint8 *) (entry->data)), j);
  				}
! 				if (i + 2 < length)
! 					i += 3;
! 				else
! 					i += 2;
  				length -= i;
  				/* this will move pointer from start to first character after FE command */
--- 2481,2485 ----
  						DO_GLYPH(((uint8 *) (entry->data)), j);
  				}
! 				i += 3;
  				length -= i;
  				/* this will move pointer from start to first character after FE command */



-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
Register for a JBoss Training Course.  Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click