[Libreoffice] [PATCH] crashing oosplash and malformed picture (bnc#652562)

Hi,

the attached patch fixes crashing oosplash and malformed picture.

The first line fixes accessing aliased out buffer, see
https://bugzilla.novell.com/show_bug.cgi?id=652562#c22

The second line fixes broken if/if/else condition to do not bump the out
pointer twice, see
https://bugzilla.novell.com/show_bug.cgi?id=652562#c16

It might be worth to add it into libreoffice-3-3-1 branch.

We already have confirmation from the reporter for the second line. I
was able to reproduce the 1st line problem here and the fix helped.

Could you please review it?


Best Regards,
Petr

--- desktop/unx/source/splashx.c.old    2010-11-11 16:30:07.000000000 +0100
+++ desktop/unx/source/splashx.c        2011-02-11 21:46:52.000000000 +0100
@@ -333,6 +333,7 @@ static void create_pixmap()
             int x, y; \
             for ( y = 0; y < height; ++y ) \
             { \
+                out = data + y * bytes_per_line; \
                 unsigned long red_delta = 0, green_delta = 0, blue_delta = 0; \
                 color_t *in = (color_t *)bitmap_rows[y]; \
                 for ( x = 0; x < width; ++x, ++in  ) \
@@ -376,7 +376,7 @@ static void create_pixmap()
         {
             if ( machine_byte_order == byte_order && byte_order == LSBFirst )
                 COPY_IN_OUT( 3, *( (color_t *)out ) = *( (color_t *)( &pixel ) ); out += 3; )
-            if ( machine_byte_order == byte_order && byte_order == MSBFirst )
+            else if ( machine_byte_order == byte_order && byte_order == MSBFirst )
                 COPY_IN_OUT( 3, uint32_t tmp = pixel;
                              *( (uint8_t *)out     ) = *( (uint8_t *)(&tmp) + 1 );
                              *( (uint8_t *)out + 1 ) = *( (uint8_t *)(&tmp) + 2 );