[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/opengl

[Jan Holesovsky]

 vcl/opengl/salbmp.cxx |   18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

New commits:
commit 90bbc7eacfa160c44a83fafbd11db12c28490879
Author: Jan Holesovsky <kendy at collabora.com>
Date:   Thu Sep 3 16:52:59 2015 +0200

    tdf#93892: Un-share maUserBuffer when the BitmapWriteAccess is requested.
    
    Otherwise Bad Things Happen, and we may accidentally overwrite random other / shared data.
    
    Change-Id: I463354a6e910a2cb43faa229708fe5c14c79535a
    Reviewed-on: https://gerrit.libreoffice.org/18309
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/vcl/opengl/salbmp.cxx b/vcl/opengl/salbmp.cxx
index e76ebd7..05a55d7 100644
--- a/vcl/opengl/salbmp.cxx
+++ b/vcl/opengl/salbmp.cxx
@@ -141,9 +141,15 @@ bool OpenGLSalBitmap::Create( const SalBitmap& rSalBmp, sal_uInt16 nNewBitCount
         // execute any pending operations on the source bitmap
         maTexture = rSourceBitmap.GetTexture();
         mbDirtyTexture = false;
+
+        // be careful here, we are share & reference-count the
+        // maUserBuffer, BUT this Create() is called from
+        // Bitmap::ImplMakeUnique().
+        // Consequently, there might be cases when this needs to be made
+        // unique later (when we don't do that right away here), like when
+        // using the BitmapWriteAccess.
         maUserBuffer = rSourceBitmap.maUserBuffer;
 
-        // TODO Copy buffer data if the bitcount and palette are the same
         return true;
     }
     return false;
@@ -649,6 +655,16 @@ BitmapBuffer* OpenGLSalBitmap::AcquireBuffer( BitmapAccessMode nMode )
         }
     }
 
+    // maUserBuffer must be unique when we are doing the write access
+    if (nMode == BITMAP_WRITE_ACCESS && maUserBuffer && !maUserBuffer.unique())
+    {
+        basebmp::RawMemorySharedArray aBuffer(maUserBuffer);
+
+        maUserBuffer.reset();
+        AllocateUserData();
+        memcpy(maUserBuffer.get(), aBuffer.get(), static_cast<sal_uInt32>(mnBytesPerRow) * mnHeight);
+    }
+
     BitmapBuffer* pBuffer = new BitmapBuffer;
     pBuffer->mnWidth = mnWidth;
     pBuffer->mnHeight = mnHeight;