From: Dimitri Schoolwerth <dimitri.schoolwerth@gmail.com>
Date: Sun, 28 Aug 2011 21:49:28 +0000 (+0000)
Subject: Fixed accessing out-of-bounds image coordinates while writing a black and white TIFF... 
X-Git-Url: https://git.saurik.com/wxWidgets.git/commitdiff_plain/f2de33ede42de733a5cf3ab59dcd1c848165c7d4

Fixed accessing out-of-bounds image coordinates while writing a black and white TIFF image.

The code assumed that the image's width is a multiple of 8, and attempted to always write per 8 pixels instead of sometimes having to write fewer pixels for the last column.

Also fixed compilo from previous commit due to not removing old code.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@68942 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
---

diff --git a/src/common/imagtiff.cpp b/src/common/imagtiff.cpp
index 2d224133c4..a426c6a8b4 100644
--- a/src/common/imagtiff.cpp
+++ b/src/common/imagtiff.cpp
@@ -643,10 +643,6 @@ bool wxTIFFHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbo
     // scanlinesize is determined by spp and bps
     const tsize_t linebytes =
         (tsize_t)((image->GetWidth() * spp * bps + 7) / 8);
-    tsize_t linebytes = (tsize_t)image->GetWidth() * spp * bps / 8;
-
-    if ( (image->GetWidth() % 8 > 0) && (spp * bps < 8) )
-        linebytes+=1;
 
     unsigned char *buf;
 
@@ -672,6 +668,17 @@ bool wxTIFFHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbo
 
     TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP,TIFFDefaultStripSize(tif, (uint32) -1));
 
+    const int bitsPerPixel = spp * bps;
+    const int pixelsPerByte = 8 / bitsPerPixel;
+    int remainingPixelCount = 0;
+
+    if (pixelsPerByte)
+    {
+        // How many pixels to write in the last byte column?
+        remainingPixelCount = image->GetWidth() % pixelsPerByte;
+        if (!remainingPixelCount) remainingPixelCount = 8;
+    }
+
     const bool minIsWhite = (photometric == PHOTOMETRIC_MINISWHITE);
     unsigned char *ptr = image->GetData();
     for ( int row = 0; row < image->GetHeight(); row++ )
@@ -701,7 +708,10 @@ bool wxTIFFHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbo
                 for ( int column = 0; column < linebytes; column++ )
                 {
                     uint8 reverse = 0;
-                    for ( int bp = 0; bp < 8; bp++ )
+                    int pixelsPerByteCount = (column + 1 != linebytes)
+                        ? pixelsPerByte
+                        : remainingPixelCount;
+                    for ( int bp = 0; bp < pixelsPerByteCount; bp++ )
                     {
                         if ( (ptr[column*24 + bp*3 + 1] <=127) == minIsWhite )
                         {