[base] Fix bitmap copying where the new pitch is smaller.

* src/base/ftbitmap.c (ft_bitmap_assure_buffer): Handle it.

2 files changed, 50 insertions, 14 deletions

diff --git a/ChangeLog b/ChangeLog
index 4dc8c552a..5cdf5be14 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
 2018-04-22  Werner Lemberg  <wl@gnu.org>
 
+	[base] Fix bitmap copying where the new pitch is smaller.
+
+	* src/base/ftbitmap.c (ft_bitmap_assure_buffer): Handle it.
+
+2018-04-22  Werner Lemberg  <wl@gnu.org>
+
 	Another fix for handling invalid format 2 cmaps.
 
 	The previous commit was incomplete.
diff --git a/src/base/ftbitmap.c b/src/base/ftbitmap.c
index 93efb0944..4f5ca5a59 100644
--- a/src/base/ftbitmap.c
+++ b/src/base/ftbitmap.c
@@ -237,20 +237,35 @@
       unsigned char*  out = buffer;
 
       unsigned char*  limit = bitmap->buffer + pitch * bitmap->rows;
-      unsigned int    delta = new_pitch - pitch;
 
 
       FT_MEM_ZERO( out, new_pitch * ypixels );
       out += new_pitch * ypixels;
 
-      while ( in < limit )
+      if ( new_pitch > pitch )
       {
-        FT_MEM_COPY( out, in, len );
-        in  += pitch;
-        out += pitch;
+        unsigned int  delta = new_pitch - pitch;
 
-        FT_MEM_ZERO( out, delta );
-        out += delta;
+
+        while ( in < limit )
+        {
+          FT_MEM_COPY( out, in, len );
+          in  += pitch;
+          out += pitch;
+
+          /* we have to zero out the new (unused) pitch bytes */
+          FT_MEM_ZERO( out, delta );
+          out += delta;
+        }
+      }
+      else
+      {
+        while ( in < limit )
+        {
+          FT_MEM_COPY( out, in, len );
+          in  += pitch;
+          out += new_pitch;
+        }
       }
     }
     else
@@ -261,17 +276,32 @@
       unsigned char*  out = buffer;
 
       unsigned char*  limit = bitmap->buffer + pitch * bitmap->rows;
-      unsigned int    delta = new_pitch - pitch;
 
 
-      while ( in < limit )
+      if ( new_pitch > pitch )
       {
-        FT_MEM_COPY( out, in, len );
-        in  += pitch;
-        out += pitch;
+        unsigned int  delta = new_pitch - pitch;
 
-        FT_MEM_ZERO( out, delta );
-        out += delta;
+
+        while ( in < limit )
+        {
+          FT_MEM_COPY( out, in, len );
+          in  += pitch;
+          out += pitch;
+
+          /* we have to zero out the new (unused) pitch bytes */
+          FT_MEM_ZERO( out, delta );
+          out += delta;
+        }
+      }
+      else
+      {
+        while ( in < limit )
+        {
+          FT_MEM_COPY( out, in, len );
+          in  += pitch;
+          out += new_pitch;
+        }
       }
 
       FT_MEM_ZERO( out, new_pitch * ypixels );