Attached patch fixes crash in xv in smoothY(). The for()-loop iterates one too many times, and make clptr to point to out-of-bound memory, and later, cptr is assigned based on clptr (line 393) and causes a crash when dereferenced (line 398).
Test image[1] from post[2] with following command on my 1366x768 display (on amd64): $ xv -rmode 5 -quit -max openbsd.jpg The patch also fixes another for(i=0; i <=shigh; i++) case in smoothXY() (line 471). I don't have a test-case for this, but visually looks wrong. --patrick p.s., note that this patch is post-jump-patch applied. [1] http://openbsd-france.org/goodies/wallpapers/openbsd.jpg [2] http://marc.info/?l=openbsd-misc&m=130608796413023&w=2
patch-xvsmooth_c
Description: Binary data
