hitoshura25/cvefixes huggingface dataset:
CVE-2020-5209 (C, published 2020-01-28T18:15Z)
Description: value: In NetHack before 3.6.5, unknown options starting with -de and -i can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to influence command line options. Users should upgrade to NetHack 3.6.5.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/NetHack/NetHack
Files changed:
doc/fixes36.5
src/topten.c
src/windows.c
sys/unix/unixmain.c
Commit message: command line triggered buffer overruns

Prevent extremely long command line arguments from overflowing local
buffers in raw_printf or config_error_add.  The increased buffer
sizes they recently got to deal with long configuration file values
aren't sufficient to handle command line induced overflows.

choose_windows(core): copy and truncate the window_type argument in
case it gets passed to config_error_add().

process_options(unix): report bad values with "%.60s" so that vsprintf
will implicitly truncate when formatted by raw_printf().


Vulnerable code:
    register int i;
        raw_printf("No window types?");
                raw_printf("Unknown option: %s", *argv);

                raw_printf("Unknown option: %s", *argv);
            /* else raw_printf("Unknown option: %s", *argv); */

Fixed code:
	via bad config file values or command line arguments
fix potential buffer overflow in choose_windows()
 * caveat: some shells might allow argv elements to be arbitrarily long.
    int i;
    char *tmps = 0;
        raw_printf("No window types supported?");
    /* 50: arbitrary, no real window_type names are anywhere near that long;
       used to prevent potential raw_printf() overflow if user supplies a
       very long string (on the order of 1200 chars) on the command line
       (config file options can't get that big; they're truncated at 1023) */
#define WINDOW_TYPE_MAXLEN 50
    if (strlen(s) >= WINDOW_TYPE_MAXLEN) {
        tmps = (char *) alloc(WINDOW_TYPE_MAXLEN);
        (void) strncpy(tmps, s, WINDOW_TYPE_MAXLEN - 1);
        tmps[WINDOW_TYPE_MAXLEN - 1] = '\0';
        s = tmps;
    }
#undef WINDOW_TYPE_MAXLEN

    if (tmps)
        free((genericptr_t) tmps) /*, tmps = 0*/ ;
/* caveat: argv elements might be arbitrary long */
                raw_printf("Unknown option: %.60s", *argv);
                raw_printf("Unknown option: %.60s", *argv);
            /* else raw_printf("Unknown option: %.60s", *argv); */
CVE-2020-5210 (C, published 2020-01-28T18:15Z)
Description: value: In NetHack before 3.6.5, an invalid argument to the -w command line option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to influence command line options. Users should upgrade to NetHack 3.6.5.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/NetHack/NetHack
Files changed:
doc/fixes36.5
src/topten.c
src/windows.c
sys/unix/unixmain.c
Commit message: command line triggered buffer overruns

Prevent extremely long command line arguments from overflowing local
buffers in raw_printf or config_error_add.  The increased buffer
sizes they recently got to deal with long configuration file values
aren't sufficient to handle command line induced overflows.

choose_windows(core): copy and truncate the window_type argument in
case it gets passed to config_error_add().

process_options(unix): report bad values with "%.60s" so that vsprintf
will implicitly truncate when formatted by raw_printf().


Vulnerable code:
    register int i;
        raw_printf("No window types?");
                raw_printf("Unknown option: %s", *argv);

                raw_printf("Unknown option: %s", *argv);
            /* else raw_printf("Unknown option: %s", *argv); */

Fixed code:
	via bad config file values or command line arguments
fix potential buffer overflow in choose_windows()
 * caveat: some shells might allow argv elements to be arbitrarily long.
    int i;
    char *tmps = 0;
        raw_printf("No window types supported?");
    /* 50: arbitrary, no real window_type names are anywhere near that long;
       used to prevent potential raw_printf() overflow if user supplies a
       very long string (on the order of 1200 chars) on the command line
       (config file options can't get that big; they're truncated at 1023) */
#define WINDOW_TYPE_MAXLEN 50
    if (strlen(s) >= WINDOW_TYPE_MAXLEN) {
        tmps = (char *) alloc(WINDOW_TYPE_MAXLEN);
        (void) strncpy(tmps, s, WINDOW_TYPE_MAXLEN - 1);
        tmps[WINDOW_TYPE_MAXLEN - 1] = '\0';
        s = tmps;
    }
#undef WINDOW_TYPE_MAXLEN

    if (tmps)
        free((genericptr_t) tmps) /*, tmps = 0*/ ;
/* caveat: argv elements might be arbitrary long */
                raw_printf("Unknown option: %.60s", *argv);
                raw_printf("Unknown option: %.60s", *argv);
            /* else raw_printf("Unknown option: %.60s", *argv); */
CVE-2017-18183 (C++, published 2018-02-13T19:29Z)
Description: value: An issue was discovered in QPDF before 7.0.0. There is an infinite loop in the QPDFWriter::enqueueObject() function in libqpdf/QPDFWriter.cc.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/qpdf/qpdf
Files changed:
libqpdf/QPDFWriter.cc
qpdf/qpdf.testcov
qpdf/qtest/qpdf.test
qpdf/qtest/qpdf/issue-143.out
Commit message: Fix infinite loop in QPDFWriter (fixes #143)


Vulnerable code:

Fixed code:
                // Detect loops by storing invalid object ID 0, which
                // will get overwritten later.
                obj_renumber[og] = 0;
        else if (obj_renumber[og] == 0)
        {
            // This can happen if a specially constructed file
            // indicates that an object stream is inside itself.
            QTC::TC("qpdf", "QPDFWriter ignore self-referential object stream");
        }
QPDFWriter ignore self-referential object stream 0
    ["143", "self-referential ostream", 3],
WARNING: issue-143.pdf: can't find PDF header
WARNING: issue-143.pdf (xref stream: object 3 0, file position 654): stream keyword not followed by proper line terminator
WARNING: issue-143.pdf (xref stream: object 3 0, file position 607): stream dictionary lacks /Length key
WARNING: issue-143.pdf (xref stream: object 3 0, file position 654): attempting to recover stream length
WARNING: issue-143.pdf (xref stream: object 3 0, file position 654): recovered stream length: 36
WARNING: issue-143.pdf (xref stream: object 3 0, file position 694): expected endobj
WARNING: issue-143.pdf: file is damaged
WARNING: issue-143.pdf (object 1 0, file position 48): expected n n obj
WARNING: issue-143.pdf: Attempting to reconstruct cross-reference table
WARNING: issue-143.pdf (file position 24): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: issue-143.pdf (file position 24): expected dictionary key but found non-name object; inserting key /QPDFFake2
WARNING: issue-143.pdf (file position 24): expected dictionary key but found non-name object; inserting key /QPDFFake3
WARNING: issue-143.pdf (file position 24): expected dictionary key but found non-name object; inserting key /QPDFFake4
WARNING: issue-143.pdf (object 1 0, file position 21): stream dictionary lacks /Length key
WARNING: issue-143.pdf (object 1 0, file position 84): attempting to recover stream length
WARNING: issue-143.pdf (object 1 0, file position 84): recovered stream length: 606
WARNING: issue-143.pdf (object 1 0, file position 694): expected endobj
WARNING: object stream 1 (file position 33): expected dictionary key but found non-name object; inserting key /QPDFFake1
qpdf: operation succeeded with warnings; resulting file may have some problems
CVE-2017-18184 (C++, published 2018-02-13T19:29Z)
Description: value: An issue was discovered in QPDF before 7.0.0. There is a stack-based out-of-bounds read in the function iterate_rc4 in QPDF_encryption.cc.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/qpdf/qpdf
Files changed:
libqpdf/QPDF_encryption.cc
Commit message: Pad keys to avoid memory errors (fixes #147)


Vulnerable code:
    iterate_rc4(O_data, key_bytes, key, data.getLengthBytes(),
        if ((O.length() < OU_key_bytes_V5) ||
            (U.length() < OU_key_bytes_V5) ||
            (OE.length() < OUE_key_bytes_V5) ||
            (UE.length() < OUE_key_bytes_V5) ||
            (Perms.length() < Perms_key_bytes_V5))
        {
            throw QPDFExc(qpdf_e_damaged_pdf, this->m->file->getName(),
                          "encryption dictionary",
                          this->m->file->getLastOffset(),
                          "incorrect length for some of"
                          " /O, /U, /OE, /UE, or /Perms in"
                          " encryption dictionary");
        }

Fixed code:
    std::string k1(reinterpret_cast<char*>(O_key), OU_key_bytes_V4);
    pad_short_parameter(k1, data.getLengthBytes());
    pad_short_parameter(k1, data.getLengthBytes());
    pad_short_parameter(k1, data.getLengthBytes());
    std::string k1(reinterpret_cast<char*>(key), OU_key_bytes_V4);
    pad_short_parameter(k1, data.getLengthBytes());
    iterate_rc4(O_data, key_bytes, QUtil::unsigned_char_pointer(k1),
                data.getLengthBytes(),
        // These must be exactly the right number of bytes.
        // These may be longer than the minimum number of bytes.
CVE-2017-18185 (Other, published 2018-02-13T19:29Z)
Description: value: An issue was discovered in QPDF before 7.0.0. There is a large heap-based out-of-bounds read in the Pl_Buffer::write function in Pl_Buffer.cc. It is caused by an integer overflow in the PNG filter.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/qpdf/qpdf
Files changed:
qpdf/qtest/qpdf.test
qpdf/qtest/qpdf/issue-150.out
qpdf/qtest/qpdf/issue-150.pdf
Commit message: Add test case for overflow in PNG filter (fixes #150)


Vulnerable code:

Fixed code:
    ["150", "integer overflow", 2],
WARNING: issue-150.pdf: can't find PDF header
overflow/underflow converting 9900000000000000000 to 64-bit integer
00008 0 obj<</Type/XRef/Filter/Fl/DecodeParms<</Columns 9900000000000000000/Predictor 12>>/W[0 2 0]/Size 0>>stream
xc0endobj
startxref
4
CVE-2017-18186 (Other, published 2018-02-13T19:29Z)
Description: value: An issue was discovered in QPDF before 7.0.0. There is an infinite loop due to looping xref tables in QPDF.cc.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/qpdf/qpdf
Files changed:
ChangeLog
libqpdf/QPDF.cc
qpdf/qtest/qpdf.test
qpdf/qtest/qpdf/issue-149.out
qpdf/qtest/qpdf/issue-149.pdf
Commit message: Detect xref pointer infinite loop (fixes #149)


Vulnerable code:

Fixed code:
2017-08-25  Jay Berkenbilt  <ejb@ql.org>

	* Detect infinite loop while finding additional xref tables. Fixes
	#149.

    std::set<qpdf_offset_t> visited;
        visited.insert(xref_offset);
        if (visited.count(xref_offset) != 0)
        {
            xref_offset = 0;
        }
    ["149", "xref prev pointer loop", 3],
WARNING: issue-149.pdf: reported number of objects (11) inconsistent with actual number of objects (7)
qpdf: operation succeeded with warnings; resulting file may have some problems
%PDF-1.7
%Á∑·∂
% vim: set tw=76 ts=2 et :
% convert with:
% ./fixlengths < hello.txt > hello.pdf ; ./genxref hello.pdf
1 0 obj
  <<  /Type /Catalog
      /Outlines 6 0 R
      /Pages 2 0 R
  >>
endobj

2 0 obj
  <<  /Type /Pages
      /Kids [3 0 R]
      /Count 1
  >>
endobj

3 0 obj
  <<  /Type /Page
      /Parent 2 0 R
      /MediaBox [0 0 595.276 841.89]
      /Contents 4 0 R
      /Resources <<
        /ProcSet [/PDF /Text]
        /Font << /F1 5 0 R >>
        >>
  >>
endobj

4 0 obj
  <<  /Length 36  >>
stream
  BT 80 100 Td /F1 48 Tf (foo) Tj ET
endstream
endobj

5 0 obj
  <<  /Type /Font
      /Subtype /Type1
      /Name /F1
      /BaseFont /Helvetica
      /Encoding /MacRomanEncoding
  >>
endobj

6 0 obj
  <<  /Type /Outlines
      /Count 0
  >>
endobj

xref
0 7
0000000000 65535 f
0000000125 00000 n
0000000208 00000 n
0000000283 00000 n
0000000492 00000 n
0000000583 00000 n
0000000721 00000 n

trailer
  <<  /Size 7
      /Prev 1516
      /Root 1 0 R
  >>
startxref
779%%EOF

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
1 1 obj
  <<  /Type /Catalog
      /Outlines 6 0 R
      /Pages 2 1 R
  >>
endobj

2 1 obj
  <<  /Type /Pages
      /Kids [3 1 R]
      /Count 1
  >>
endobj

3 1 obj
  <<  /Type /Page
      /Parent 2 1 R
      /MediaBox [0 0 595.276 841.89]
      /Contents 4 1 R
      /Resources <<
        /ProcSet [/PDF /Text]
        /Font << /F1 5 0 R >>
        >>
  >>
endobj

4 1 obj
  <<  /Length 36  >>
stream
  BT 80 100 Td /F1 48 Tf (bar) Tj ET
endstream
endobj

xref
1 4
0000001058 00001 n
0000001141 00001 n
0000001216 00001 n
0000001425 00001 n

trailer
  <<  /Size 11
      /Prev 779
      /Root 1 1 R
  >>
startxref
1516
%%EOF
CVE-2018-9918 (Other, published 2018-04-10T18:29Z)
Description: value: libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing remote attackers to cause a denial of service (stack exhaustion), related to the QPDFObjectHandle and QPDF_Dictionary classes, because nesting in direct objects is not restricted.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/qpdf/qpdf
Files changed:
ChangeLog
libqpdf/QPDFObjectHandle.cc
qpdf/qpdf.testcov
qpdf/qtest/qpdf.test
qpdf/qtest/qpdf/issue-146.out
qpdf/qtest/qpdf/issue-202.out
Commit message: Limit depth of nesting in direct objects (fixes #202)

This fixes CVE-2018-9918.


Vulnerable code:
            olist_stack.push_back(std::vector<QPDFObjectHandle>());
            state = st_start;
            offset_stack.push_back(input->tell());
            state_stack.push_back(
                (token.getType() == QPDFTokenizer::tt_array_open) ?
                st_array : st_dictionary);
WARNING: issue-146.pdf (trailer, offset 20728): unknown token while reading object; treating as string
WARNING: issue-146.pdf (trailer, offset 20732): unexpected EOF
WARNING: issue-146.pdf (trailer, offset 20732): parse error while reading object

Fixed code:
2018-04-15  Jay Berkenbilt  <ejb@ql.org>

	* Arbitrarily limit the depth of data structures represented by
	direct object. This is CVE-2018-9918. Fixes #202.

            if (olist_stack.size() > 500)
            {
		QTC::TC("qpdf", "QPDFObjectHandle too deep");
                warn(context,
                     QPDFExc(qpdf_e_damaged_pdf, input->getName(),
                             object_description,
                             input->getLastOffset(),
                             "ignoring excessively deeply nested data structure"));
                object = newNull();
                state = st_top;
            }
            else
            {
                olist_stack.push_back(std::vector<QPDFObjectHandle>());
                state = st_start;
                offset_stack.push_back(input->tell());
                state_stack.push_back(
                    (token.getType() == QPDFTokenizer::tt_array_open) ?
                    st_array : st_dictionary);
            }
QPDFObjectHandle too deep 0
    ["202", "even more deeply nested dictionary", 2],
WARNING: issue-146.pdf (trailer, offset 695): ignoring excessively deeply nested data structure
WARNING: issue-202.pdf (trailer, offset 55770): ignoring excessively deeply nested data structure
WARNING: issue-202.pdf: file is damaged
WARNING: issue-202.pdf (offset 54769): expected trailer dictionary
WARNING: issue-202.pdf: Attempting to reconstruct cross-reference table
issue-202.pdf: unable to find trailer dictionary while recovering damaged file
CVE-2021-36978 (C++, published 2021-07-20T07:15Z)
Description: value: QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF::finish) when a certain downstream write fails.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/qpdf/qpdf
Files changed:
ChangeLog
libqpdf/Pl_AES_PDF.cc
libqpdf/Pl_ASCII85Decoder.cc
libqpdf/Pl_ASCIIHexDecoder.cc
libqpdf/Pl_Count.cc
Commit message: Fix some pipelines to be safe if downstream write fails (fuzz issue 28262)


Vulnerable code:
    getNext()->write(this->outbuf, bytes);
    getNext()->write(outbuf, this->pos - 1);

    getNext()->write(&ch, 1);

	getNext()->write(buf, len);

Fixed code:
2021-01-04  Jay Berkenbilt  <ejb@ql.org>

	* Move getNext()->write() calls in some pipelines to ensure that
	state gates properly reset even if the next pipeline's write
	throws an exception (fuzz issue 28262).

    getNext()->write(this->outbuf, bytes);
    // Reset before calling getNext()->write in case that throws an
    // exception.
    auto t = this->pos - 1;

    getNext()->write(outbuf, t);
    // Reset before calling getNext()->write in case that throws an
    // exception.

    getNext()->write(&ch, 1);
	getNext()->write(buf, len);
CVE-2018-10677 (C, published 2018-05-02T19:29Z)
Description: value: The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 lacks certain checks against width and height, which allows remote attackers to cause a denial of service (WritePixels heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted GIF file.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/miniupnp/ngiflib
Files changed:
ngiflib.c
Commit message: check GIF image position and dimensions

fixes #1


Vulnerable code:

Fixed code:
	if((i->width > i->parent->width) || (i->height > i->parent->height)) {
#if !defined(NGIFLIB_NO_FILE)
		if(i->parent->log) fprintf(i->parent->log, "*** ERROR *** Image bigger than global GIF canvas !\n");
#endif
		return -1;
	}
	if((i->posX + i->width) > i->parent->width) {
#if !defined(NGIFLIB_NO_FILE)
		if(i->parent->log) fprintf(i->parent->log, "*** WARNING *** Adjusting X position\n");
#endif
		i->posX = i->parent->width - i->width;
	}
	if((i->posY + i->height) > i->parent->height) {
#if !defined(NGIFLIB_NO_FILE)
		if(i->parent->log) fprintf(i->parent->log, "*** WARNING *** Adjusting Y position\n");
#endif
		i->posY = i->parent->height - i->height;
	}
CVE-2018-10717 (C, published 2018-05-03T17:29Z)
Description: value: The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 does not consider the bounds of the pixels data structure, which allows remote attackers to cause a denial of service (WritePixels heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted GIF file, a different vulnerability than CVE-2018-10677.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/miniupnp/ngiflib
Files changed:
ngiflib.c
Commit message: fix "pixel overrun"

fixes #3


Vulnerable code:
			WritePixel(i, &context, casspecial); npix--;
			WritePixels(i, &context, stackp, stack_top - stackp);	/* unstack all pixels at once */

Fixed code:
			if(npix > 0) WritePixel(i, &context, casspecial);
			npix--;
			if(npix >= (stack_top - stackp)) {
				WritePixels(i, &context, stackp, stack_top - stackp);	/* unstack all pixels at once */
			} else if(npix > 0) {	/* "pixel overflow" */
				WritePixels(i, &context, stackp, npix);
			}
CVE-2019-16346 (C, published 2019-09-16T13:15Z)
Description: value: ngiflib 0.4 has a heap-based buffer overflow in WritePixel() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-682 \u2014 Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
Repository: https://github.com/miniupnp/ngiflib
Files changed:
ngiflib.c
Commit message: fix deinterlacing for small pictures

fixes #12


Vulnerable code:
 * (c) 2004-2017 Thomas Bernard. All rights reserved
			if(context->curY >= p->height) {
				context->pass++;
				context->curY = i->posY + 4;
			}
			if(context->curY >= p->height) {
				context->pass++;
				context->curY = i->posY + 2;
			}
			if(context->curY >= p->height) {
				context->pass++;
				context->curY = i->posY + 1;
			}
				if(context->curY >= p->height) {
					context->pass++;
					context->curY = i->posY + 4;
				}
				if(context->curY >= p->height) {
					context->pass++;
					context->curY = i->posY + 2;
				}
				if(context->curY >= p->height) {
					context->pass++;
					context->curY = i->posY + 1;
				}

Fixed code:
 * (c) 2004-2019 Thomas Bernard. All rights reserved
		while(context->pass > 0 && context->pass < 4 &&
		      context->curY >= p->height) {
			switch(++context->pass) {
			case 2:	/* 2nd pass : every eighth row starting from 4 */
				context->curY = i->posY + 4;
				break;
			case 3:	/* 3rd pass : every fourth row starting from 2 */
				context->curY = i->posY + 2;
				break;
			case 4:	/* 4th pass : every odd row */
				context->curY = i->posY + 1;
				break;
			}
		}
			while(context->pass > 0 && context->pass < 4 &&
			      context->curY >= p->height) {
				switch(++context->pass) {
				case 2:	/* 2nd pass : every eighth row starting from 4 */
					context->curY = i->posY + 4;
					break;
				case 3:	/* 3rd pass : every fourth row starting from 2 */
					context->curY = i->posY + 2;
					break;
				case 4:	/* 4th pass : every odd row */
					context->curY = i->posY + 1;
					break;
				}
			}