[Mplayer-cvslog] CVS: main/libmenu menu.c,1.2,1.3

[Alban Bedel CVS]

Update of /cvsroot/mplayer/main/libmenu
In directory mail:/var/tmp.root/cvs-serv27871/libmenu

Modified Files:
	menu.c 
Log Message:
Fix buffer overflow in a drawing func


Index: menu.c
===================================================================
RCS file: /cvsroot/mplayer/main/libmenu/menu.c,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- menu.c	18 Nov 2002 00:09:37 -0000	1.2
+++ menu.c	18 Nov 2002 20:43:29 -0000	1.3
@@ -357,7 +357,7 @@
   if(align & MENU_TEXT_VCENTER)
     sy = ymin + ((h - need_h)/2);
   else if(align & MENU_TEXT_BOT) 
-    sy = ymax - need_h;
+    sy = ymax - need_h - 1;
   else
     sy = y;
 
@@ -443,7 +443,7 @@
 	if(align & MENU_TEXT_HCENTER)
 	  sx = xmid - ll/2;
 	else
-	  sx = xmax - ll;
+	  sx = xmax - 1 - ll;
       }
     } else {
       for(sx = xrmin ;  sx < xmin && txt != line_end ; txt++) {
@@ -455,15 +455,20 @@
     while(sx < xmax && txt != line_end) {
       unsigned char c = *txt++;
       font = vo_font->font[c];
-      if ( (font >= 0) && (sx + vo_font->width[c] <= xmax) /*&& (sy + vo_font->pic_a[font]->h <= ymax)*/)
-	draw_alpha(vo_font->width[c], vo_font->pic_a[font]->h,
-		   vo_font->pic_b[font]->bmp+vo_font->start[c],
-		   vo_font->pic_a[font]->bmp+vo_font->start[c],
-		   vo_font->pic_a[font]->w,
-		   mpi->planes[0] + sy * mpi->stride[0] + sx * (mpi->bpp>>3),
-		   mpi->stride[0]);
-/*        else */
-/* 	printf("Can't draw '%c'\n",c); */
+      if(font >= 0) {
+ 	int cs = (vo_font->pic_a[font]->h - vo_font->height) / 2;
+	if ((sx + vo_font->width[c] < xmax)  &&  (sy + vo_font->height < ymax) )
+	  draw_alpha(vo_font->width[c], vo_font->height,
+		     vo_font->pic_b[font]->bmp+vo_font->start[c] +
+		     cs * vo_font->pic_a[font]->w,
+		     vo_font->pic_a[font]->bmp+vo_font->start[c] +
+		     cs * vo_font->pic_a[font]->w,
+		     vo_font->pic_a[font]->w,
+		     mpi->planes[0] + sy * mpi->stride[0] + sx * (mpi->bpp>>3),
+		     mpi->stride[0]);
+	//	else
+	//printf("Can't draw '%c'\n",c);
+      }
       sx+=vo_font->width[c]+vo_font->charspace;
     }
     txt = line_end;