From b099dea74a21c035a66365a9f9182cc71d32972d Mon Sep 17 00:00:00 2001
From: Ander Conselvan de Oliveira <ander@mandriva.com.br>
Date: Wed, 14 Jan 2009 11:59:40 -0500
Subject: [PATCH 705/705] Fix bug 41583.

The crash was happening because the length in bytes of the line of the
updated rectangle was not calculated properly.
---
 hw/vnc/translate.c |   11 +++++------
 1 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/hw/vnc/translate.c b/hw/vnc/translate.c
index b9ab53e..0d7428c 100644
--- a/hw/vnc/translate.c
+++ b/hw/vnc/translate.c
@@ -166,19 +166,18 @@ rfbTranslateNone(ScreenPtr pScreen, char *table, rfbPixelFormat *in, rfbPixelFor
 		 unsigned char *optr, int bytesBetweenInputLines,
 		 int width, int height, int x, int y)
 {
-    VNCSCREENPTR(pScreen);
     DrawablePtr pDraw = (DrawablePtr)WindowTable[pScreen->myNum];
-    int truewidth = PixmapBytePad(width, in->bitsPerPixel) / 4;
+    int width_in_bytes = PixmapBytePad(width, in->bitsPerPixel);
 
-    if ((x + truewidth > pVNC->width) || truewidth != width) {
-	unsigned char *buffer = malloc(truewidth * height * in->bitsPerPixel / 8);
+    if (width * in->bitsPerPixel / 8 != width_in_bytes) {
+	unsigned char *buffer = malloc(width_in_bytes * height);
 	unsigned char *buf = buffer;
 	
-    	(*pScreen->GetImage)(pDraw, x, y, truewidth, height, ZPixmap, ~0, (char*)buf);
+	(*pScreen->GetImage)(pDraw, x, y, width, height, ZPixmap, ~0, (char*)buf);
 	while (height--) {
 	    memcpy(optr, buf, width * in->bitsPerPixel / 8);
 	    optr += width * in->bitsPerPixel / 8;
-	    buf += truewidth * in->bitsPerPixel / 8;
+	    buf += width_in_bytes;
 	}
 	free(buffer);
 	return;
-- 
1.6.1