From 08c602afd87efc9104a3e1059022a8d4dcd922f6 Mon Sep 17 00:00:00 2001 From: Sergey Linev Date: Wed, 26 Aug 2026 13:24:49 +0200 Subject: [PATCH 1/2] [tgx11] fix loop in TGX11TTF::DrawImage If image larger than 50000 dots, loop may went over allocated memory and may overwrite it. --- graf2d/x11ttf/src/TGX11TTF.cxx | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/graf2d/x11ttf/src/TGX11TTF.cxx b/graf2d/x11ttf/src/TGX11TTF.cxx index d7b0cd73938f7..19bc997538bb1 100644 --- a/graf2d/x11ttf/src/TGX11TTF.cxx +++ b/graf2d/x11ttf/src/TGX11TTF.cxx @@ -268,11 +268,10 @@ void TGX11TTF::DrawImage(FT_Bitmap *source, ULong_t fore, ULong_t back, bc = bcol; dotcnt = 0; for (y = 0; y < (int) source->rows; y++) { - for (x = 0; x < (int) source->width; x++, bc++) { + for (x = 0; (x < (int) source->width) && (dotcnt < maxdots); x++, bc++, dotcnt++) { /// bc->pixel = XGetPixel(xim, bx + x, by - c->TTF::fgAscent + y); bc->pixel = XGetPixel(xim, bx + x, by + y); bc->flags = DoRed | DoGreen | DoBlue; - if (++dotcnt >= maxdots) break; } } QueryColors(fColormap, bcol, dots); @@ -280,11 +279,10 @@ void TGX11TTF::DrawImage(FT_Bitmap *source, ULong_t fore, ULong_t back, bc = bcol; dotcnt = 0; for (y = 0; y < (int) source->rows; y++) { - for (x = 0; x < (int) source->width; x++, bc++) { + for (x = 0; (x < (int) source->width) && (dotcnt < maxdots); x++, bc++, dotcnt++) { r += bc->red; g += bc->green; b += bc->blue; - if (++dotcnt >= maxdots) break; } } if (dots != 0) { From 279c78c9b478db97560b77286cd6392c01e17d42 Mon Sep 17 00:00:00 2001 From: Sergey Linev Date: Wed, 26 Aug 2026 13:28:13 +0200 Subject: [PATCH 2/2] [tgwin32] fix TGWin32::DrawImage Prevent loop going over allocated memory Only relevant for large images - over 50000 pixels --- graf2d/win32gdk/src/TGWin32.cxx | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/graf2d/win32gdk/src/TGWin32.cxx b/graf2d/win32gdk/src/TGWin32.cxx index da3810ee89554..ca34dded50366 100644 --- a/graf2d/win32gdk/src/TGWin32.cxx +++ b/graf2d/win32gdk/src/TGWin32.cxx @@ -1180,9 +1180,8 @@ void TGWin32::DrawImage(FT_Bitmap *source, ULong_t fore, ULong_t back, bc = bcol; dotcnt = 0; for (y = 0; y < (int) source->rows; y++) { - for (x = 0; x < (int) source->width; x++, bc++) { + for (x = 0; (x < (int) source->width) && (dotcnt < maxdots); x++, bc++, dotcnt++) { bc->pixel = GetPixelImage((Drawable_t)xim, bx + x, by + y); - if (++dotcnt >= maxdots) break; } } QueryColors(fColormap, bcol, dots); @@ -1190,11 +1189,10 @@ void TGWin32::DrawImage(FT_Bitmap *source, ULong_t fore, ULong_t back, bc = bcol; dotcnt = 0; for (y = 0; y < (int) source->rows; y++) { - for (x = 0; x < (int) source->width; x++, bc++) { + for (x = 0; (x < (int) source->width) && (dotcnt < maxdots); x++, bc++, dotcnt++) { r += bc->red; g += bc->green; b += bc->blue; - if (++dotcnt >= maxdots) break; } } if (dots != 0) {