File freerdp-fix-bitmap-cache.patch of Package freerdp

Index: freerdp-1.0.1/libfreerdp-cache/bitmap.c
===================================================================
--- freerdp-1.0.1.orig/libfreerdp-cache/bitmap.c
+++ freerdp-1.0.1/libfreerdp-cache/bitmap.c
@@ -162,9 +162,10 @@ rdpBitmap* bitmap_cache_get(rdpBitmapCac
 	}
 
 	if (index == BITMAP_CACHE_WAITING_LIST_INDEX)
-		index = bitmap_cache->cells[id].number - 1;
-
-	if (index > bitmap_cache->cells[id].number)
+	{
+		index = bitmap_cache->cells[id].number;
+	}
+	else if (index > bitmap_cache->cells[id].number)
 	{
 		printf("get invalid bitmap index %d in cell id: %d\n", index, id);
 		return NULL;
@@ -184,9 +185,10 @@ void bitmap_cache_put(rdpBitmapCache* bi
 	}
 
 	if (index == BITMAP_CACHE_WAITING_LIST_INDEX)
-		index = bitmap_cache->cells[id].number - 1;
-
-	if (index > bitmap_cache->cells[id].number)
+	{
+		index = bitmap_cache->cells[id].number;
+	}
+	else if (index > bitmap_cache->cells[id].number)
 	{
 		printf("put invalid bitmap index %d in cell id: %d\n", index, id);
 		return;
@@ -244,7 +246,8 @@ rdpBitmapCache* bitmap_cache_new(rdpSett
 		for (i = 0; i < (int) bitmap_cache->maxCells; i++)
 		{
 			bitmap_cache->cells[i].number = settings->bitmapCacheV2CellInfo[i].numEntries;
-			bitmap_cache->cells[i].entries = (rdpBitmap**) xzalloc(sizeof(rdpBitmap*) * bitmap_cache->cells[i].number);
+			/* allocate an extra entry for BITMAP_CACHE_WAITING_LIST_INDEX */
+			bitmap_cache->cells[i].entries = (rdpBitmap**) xzalloc(sizeof(rdpBitmap*) * (bitmap_cache->cells[i].number + 1));
 		}
 	}
 
@@ -260,7 +263,7 @@ void bitmap_cache_free(rdpBitmapCache* b
 	{
 		for (i = 0; i < (int) bitmap_cache->maxCells; i++)
 		{
-			for (j = 0; j < (int) bitmap_cache->cells[i].number; j++)
+			for (j = 0; j < (int) bitmap_cache->cells[i].number + 1; j++)
 			{
 				bitmap = bitmap_cache->cells[i].entries[j];