Fixed accessing out-of-bounds image coordinates while writing a black and white TIFF...

The code assumed that the image's width is a multiple of 8, and attempted to always write per 8 pixels instead of sometimes having to write fewer pixels for the last column.

Also fixed compilo from previous commit due to not removing old code.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@68942 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775

diff --git a/src/common/imagtiff.cpp b/src/common/imagtiff.cpp
index 2d224133c408201c9709231eebd80b87ec51faaa..a426c6a8b40020b0811ce250cc3adcdc87fc81e2 100644 (file)
--- a/src/common/imagtiff.cpp
+++ b/src/common/imagtiff.cpp
@@ -643,10 +643,6 @@ bool wxTIFFHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbo
     // scanlinesize is determined by spp and bps
     const tsize_t linebytes =
         (tsize_t)((image->GetWidth() * spp * bps + 7) / 8);
     // scanlinesize is determined by spp and bps
     const tsize_t linebytes =
         (tsize_t)((image->GetWidth() * spp * bps + 7) / 8);

-    tsize_t linebytes = (tsize_t)image->GetWidth() * spp * bps / 8;
-
-    if ( (image->GetWidth() % 8 > 0) && (spp * bps < 8) )
-        linebytes+=1;

 
     unsigned char *buf;
 
 
     unsigned char *buf;
 


@@ -672,6 +668,17 @@ bool wxTIFFHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbo
 
     TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP,TIFFDefaultStripSize(tif, (uint32) -1));
 
 
     TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP,TIFFDefaultStripSize(tif, (uint32) -1));
 

+    const int bitsPerPixel = spp * bps;
+    const int pixelsPerByte = 8 / bitsPerPixel;
+    int remainingPixelCount = 0;
+
+    if (pixelsPerByte)
+    {
+        // How many pixels to write in the last byte column?
+        remainingPixelCount = image->GetWidth() % pixelsPerByte;
+        if (!remainingPixelCount) remainingPixelCount = 8;
+    }
+

     const bool minIsWhite = (photometric == PHOTOMETRIC_MINISWHITE);
     unsigned char *ptr = image->GetData();
     for ( int row = 0; row < image->GetHeight(); row++ )
     const bool minIsWhite = (photometric == PHOTOMETRIC_MINISWHITE);
     unsigned char *ptr = image->GetData();
     for ( int row = 0; row < image->GetHeight(); row++ )


@@ -701,7 +708,10 @@ bool wxTIFFHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbo
                 for ( int column = 0; column < linebytes; column++ )
                 {
                     uint8 reverse = 0;
                 for ( int column = 0; column < linebytes; column++ )
                 {
                     uint8 reverse = 0;

-                    for ( int bp = 0; bp < 8; bp++ )
+                    int pixelsPerByteCount = (column + 1 != linebytes)
+                        ? pixelsPerByte
+                        : remainingPixelCount;
+                    for ( int bp = 0; bp < pixelsPerByteCount; bp++ )

                     {
                         if ( (ptr[column*24 + bp*3 + 1] <=127) == minIsWhite )
                         {
                     {
                         if ( (ptr[column*24 + bp*3 + 1] <=127) == minIsWhite )
                         {