all repos — openbox @ f3873cac4add6865cff6ca01abd65a31dc1b33ad

openbox fork - make it a bit more like ryudo 

Fix a write out of bounds in splitvertical gradients (Bug 3612)

If the gradient has height 1, then y1sz is 0. We don't want to use the
first color and move the data pointer, since this will move it past the
end of the array.
Dana Jansens danakj@orodu.net
commit

f3873cac4add6865cff6ca01abd65a31dc1b33ad

parent

cddd736de5933c909616f395cd774dac110ee9ae

1 files changed, 6 insertions(+), 4 deletions(-)

jump to
M obrender/gradient.c → obrender/gradient.c 
@@ -527,13 +527,15 @@ 
     /* find the color for the first pixel of each row first */
     data = sf->pixel_data;
 
-    for (y1 = y1sz-1; y1 > 0; --y1) {
+    if (y1sz) {
+        for (y1 = y1sz-1; y1 > 0; --y1) {
+            *data = COLOR(y1);
+            data += w;
+            NEXT(y1);
+        }
         *data = COLOR(y1);
         data += w;
-        NEXT(y1);
     }
-    *data = COLOR(y1);
-    data += w;
     if (y2sz) {
         for (y2 = y2sz-1; y2 > 0; --y2) {
             *data = COLOR(y2);