Fix buffer size offset error in PNG_Predictor

core/src/fxcodec/codec/fx_codec_flate.cpp

Index: core/src/fxcodec/codec/fx_codec_flate.cpp
diff --git a/core/src/fxcodec/codec/fx_codec_flate.cpp b/core/src/fxcodec/codec/fx_codec_flate.cpp
index c02f0977cf858c94fb25c1c20da837f445739984..fef4815494f747dd72320d2283ca99e91ad56fd8 100644
--- a/core/src/fxcodec/codec/fx_codec_flate.cpp
+++ b/core/src/fxcodec/codec/fx_codec_flate.cpp
@@ -409,6 +409,7 @@ static void PNG_Predictor(FX_LPBYTE& data_buf, FX_DWORD& data_size,
             byte_cnt += move_size + 1;
             continue;
         }
+        byte_cnt++;

[Tom Sepez, 2014/08/15 16:51:30]

nit: As I read this, it would make more sense to me to put this at line 401,
right after the reference to srcData[0].  After all, it is the use of that byte
as a tag that is causing the need to increment the byte_cnt.  Keeping them
together might make this more obvious.

[Bo Xu, 2014/08/15 18:08:10]

If put byte_cnt++ on line 401, then when tag==0, line 409 has already increment
byte_cnt by an offset of 1, so it will be effectively an offset of 2. I think
then we have to do 
            byte_cnt += move_size
in line 409, right?

On 2014/08/15 16:51:30, Tom Sepez wrote:

[Tom Sepez, 2014/08/15 19:02:12]

Yep. Good catch.

         for (int byte = 0; byte < row_size && byte_cnt < (int)data_size; byte ++) {
             FX_BYTE raw_byte = pSrcData[byte + 1];
             switch (tag) {
@@ -464,7 +465,6 @@ static void PNG_Predictor(FX_LPBYTE& data_buf, FX_DWORD& data_size,
         }
         pSrcData += row_size + 1;
         pDestData += row_size;
-        byte_cnt++;
     }
     FX_Free(data_buf);
     data_buf = dest_buf;