sixel: overwrite: use target sixel's height, not cell height

When copying the image data for the left and right parts of the
splitted images, use the sixel's height, not the cell height.

This fixes a crash when the sixel didn't cover the entire cell height.
This commit is contained in:
Daniel Eklöf 2020-07-23 18:13:54 +02:00
parent 3869c7299f
commit fda6e9c2c9
No known key found for this signature in database
GPG key ID: 5BBD4992C116573F
2 changed files with 6 additions and 2 deletions

View file

@ -20,6 +20,10 @@
### Deprecated
### Removed
### Fixed
* Crash when overwriting a sixel and the row being overwritten did not
cover an entire cell.
### Security

View file

@ -272,7 +272,7 @@ sixel_overwrite(struct terminal *term, struct sixel *six,
(six->pos.row + rel_above) & (term->grid->num_rows - 1)},
};
imgs[2].data = malloc(imgs[2].width * imgs[2].height * sizeof(uint32_t));
for (size_t i = 0; i < term->cell_height; i++)
for (size_t i = 0; i < imgs[2].height; i++)
memcpy(
&((uint32_t *)imgs[2].data)[i * imgs[2].width],
&((const uint32_t *)six->data)[(rel_above * term->cell_height + i) * six->width],
@ -290,7 +290,7 @@ sixel_overwrite(struct terminal *term, struct sixel *six,
(six->pos.row + rel_above) & (term->grid->num_rows - 1)},
};
imgs[3].data = malloc(imgs[3].width * imgs[3].height * sizeof(uint32_t));
for (size_t i = 0; i < term->cell_height; i++)
for (size_t i = 0; i < imgs[3].height; i++)
memcpy(
&((uint32_t *)imgs[3].data)[i * imgs[3].width],
&((const uint32_t *)six->data)[(rel_above * term->cell_height + i) * six->width + rel_right * term->cell_width],