--- sourceforge.net/trunk/rdesktop/xwin.c	2005/08/26 07:01:02	991
+++ sourceforge.net/trunk/rdesktop/xwin.c	2005/11/23 13:26:29	1031
@@ -138,10 +138,9 @@
 				XDrawArc(g_display, g_backstore, g_gc, x, y, cx, cy, 0, 360*64); \
 			break; \
 		case 1: /* Filled */ \
-			XFillArc(g_display, g_ownbackstore ? g_backstore : g_wnd, g_gc, x, y, \
-				 cx, cy, 0, 360*64); \
+			XFillArc(g_display, g_wnd, g_gc, x, y, cx, cy, 0, 360*64); \
 			if (g_ownbackstore) \
-				XCopyArea(g_display, g_backstore, g_wnd, g_gc, x, y, cx, cy, x, y); \
+				XFillArc(g_display, g_backstore, g_gc, x, y, cx, cy, 0, 360*64); \
 			break; \
 	} \
 }
@@ -2446,25 +2445,40 @@
 		switch (text[i])
 		{
 			case 0xff:
-				if (i + 2 < length)
-					cache_put_text(text[i + 1], text, text[i + 2]);
-				else
+				/* At least two bytes needs to follow */
+				if (i + 3 > length)
 				{
-					error("this shouldn't be happening\n");
-					exit(1);
+					warning("Skipping short 0xff command:");
+					for (j = 0; j < length; j++)
+						fprintf(stderr, "%02x ", text[j]);
+					fprintf(stderr, "\n");
+					i = length = 0;
+					break;
 				}
+				cache_put_text(text[i + 1], text, text[i + 2]);
+				i += 3;
+				length -= i;
 				/* this will move pointer from start to first character after FF command */
-				length -= i + 3;
-				text = &(text[i + 3]);
+				text = &(text[i]);
 				i = 0;
 				break;
 
 			case 0xfe:
+				/* At least one byte needs to follow */
+				if (i + 2 > length)
+				{
+					warning("Skipping short 0xfe command:");
+					for (j = 0; j < length; j++)
+						fprintf(stderr, "%02x ", text[j]);
+					fprintf(stderr, "\n");
+					i = length = 0;
+					break;
+				}
 				entry = cache_get_text(text[i + 1]);
-				if (entry != NULL)
+				if (entry->data != NULL)
 				{
-					if ((((uint8 *) (entry->data))[1] ==
-					     0) && (!(flags & TEXT2_IMPLICIT_X)))
+					if ((((uint8 *) (entry->data))[1] == 0)
+					    && (!(flags & TEXT2_IMPLICIT_X)) && (i + 2 < length))
 					{
 						if (flags & TEXT2_VERTICAL)
 							y += text[i + 2];