Get rid of the direct access abuse of FullFramePixelBuffer's data
diff --git a/common/rfb/PixelBuffer.h b/common/rfb/PixelBuffer.h
index bff2802..9423024 100644
--- a/common/rfb/PixelBuffer.h
+++ b/common/rfb/PixelBuffer.h
@@ -130,11 +130,10 @@
     //   pixel is the Pixel value to be used where mask_ is set
     void maskRect(const Rect& r, Pixel pixel, const void* mask_);
 
-    // *** Should this be visible?
-    rdr::U8* data;
-
   protected:
     FullFramePixelBuffer();
+
+    rdr::U8* data;
   };
 
   // -=- Managed pixel buffer class
diff --git a/common/rfb/SDesktop.h b/common/rfb/SDesktop.h
index 57ceb07..546506a 100644
--- a/common/rfb/SDesktop.h
+++ b/common/rfb/SDesktop.h
@@ -93,11 +93,11 @@
     SStaticDesktop(const Point& size) : server(0), buffer(0) {
       PixelFormat pf;
       buffer = new ManagedPixelBuffer(pf, size.x, size.y);
-      if (buffer) memset(buffer->data, 0, (pf.bpp/8) * (size.x*size.y));
+      if (buffer) buffer->fillRect(buffer->getRect(), 0);
     }
     SStaticDesktop(const Point& size, const PixelFormat& pf) : buffer(0) {
       buffer = new ManagedPixelBuffer(pf, size.x, size.y);
-      if (buffer) memset(buffer->data, 0, (pf.bpp/8) * (size.x*size.y));
+      if (buffer) buffer->fillRect(buffer->getRect(), 0);
     }
     virtual ~SStaticDesktop() {
       if (buffer) delete buffer;
diff --git a/common/rfb/VNCSConnectionST.cxx b/common/rfb/VNCSConnectionST.cxx
index a4b704a..fcb678a 100644
--- a/common/rfb/VNCSConnectionST.cxx
+++ b/common/rfb/VNCSConnectionST.cxx
@@ -1,5 +1,5 @@
 /* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
- * Copyright 2009-2011 Pierre Ossman for Cendio AB
+ * Copyright 2009-2014 Pierre Ossman for Cendio AB
  * 
  * This is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -737,13 +737,19 @@
   }
 
   // Use RichCursor
-  rdr::U8* transData = writer()->getImageBuf(server->cursor.area());
-  image_getter.translatePixels(server->cursor.data, transData,
-			       server->cursor.area());
+  rdr::U8* transBuffer;
+  int stride;
+  const rdr::U8* buffer;
+
+  transBuffer = writer()->getImageBuf(server->cursor.area());
+
+  buffer = server->cursor.getBuffer(server->cursor.getRect(), &stride);
+  image_getter.translatePixels(buffer, transBuffer, server->cursor.area());
+
   writer()->writeSetCursor(server->cursor.width(),
                            server->cursor.height(),
                            server->cursor.hotspot,
-                           transData, server->cursor.mask.buf);
+                           transBuffer, server->cursor.mask.buf);
 }
 
 
diff --git a/common/rfb/VNCServer.h b/common/rfb/VNCServer.h
index 787bf8c..c76e5c9 100644
--- a/common/rfb/VNCServer.h
+++ b/common/rfb/VNCServer.h
@@ -73,7 +73,7 @@
     // in left-to-right order.  The server takes its own copy of the data in
     // cursorData and mask.
     virtual void setCursor(int width, int height, const Point& hotspot,
-                           void* cursorData, void* mask) = 0;
+                           const void* cursorData, const void* mask) = 0;
 
     // setCursorPos() tells the server the current position of the cursor.
     virtual void setCursorPos(const Point& p) = 0;
diff --git a/common/rfb/VNCServerST.cxx b/common/rfb/VNCServerST.cxx
index db142fe..f1e378e 100644
--- a/common/rfb/VNCServerST.cxx
+++ b/common/rfb/VNCServerST.cxx
@@ -1,4 +1,5 @@
 /* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
+ * Copyright 2009-2014 Pierre Ossman for Cendio AB
  * 
  * This is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -408,11 +409,11 @@
 }
 
 void VNCServerST::setCursor(int width, int height, const Point& newHotspot,
-                            void* data, void* mask)
+                            const void* data, const void* mask)
 {
   cursor.hotspot = newHotspot;
   cursor.setSize(width, height);
-  memcpy(cursor.data, data, cursor.dataLen());
+  cursor.imageRect(cursor.getRect(), data);
   memcpy(cursor.mask.buf, mask, cursor.maskLen());
 
   cursor.crop();
@@ -621,11 +622,17 @@
     comparer->getUpdateInfo(&ui, pb->getRect());
 
   if (renderCursor) {
-    pb->getImage(renderedCursor.data,
-                 renderedCursor.getRect(renderedCursorTL));
+    const rdr::U8* buffer;
+    int stride;
+
+    buffer = pb->getBuffer(renderedCursor.getRect(renderedCursorTL), &stride);
+    renderedCursor.imageRect(renderedCursor.getRect(), buffer, stride);
+
+    buffer = cursor.getBuffer(cursor.getRect(), &stride);
     renderedCursor.maskRect(cursor.getRect(cursorTL()
                                            .subtract(renderedCursorTL)),
-                            cursor.data, cursor.mask.buf);
+                            buffer, cursor.mask.buf);
+
     renderedCursorInvalid = false;
   }
 
diff --git a/common/rfb/VNCServerST.h b/common/rfb/VNCServerST.h
index 88d0255..ed7833a 100644
--- a/common/rfb/VNCServerST.h
+++ b/common/rfb/VNCServerST.h
@@ -92,7 +92,7 @@
     virtual void add_changed(const Region &region);
     virtual void add_copied(const Region &dest, const Point &delta);
     virtual void setCursor(int width, int height, const Point& hotspot,
-                           void* cursorData, void* mask);
+                           const void* cursorData, const void* mask);
     virtual void setCursorPos(const Point& p);
 
     virtual void bell();
diff --git a/vncviewer/Viewport.cxx b/vncviewer/Viewport.cxx
index a930cf8..d1d5162 100644
--- a/vncviewer/Viewport.cxx
+++ b/vncviewer/Viewport.cxx
@@ -1,5 +1,5 @@
 /* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
- * Copyright 2011 Pierre Ossman <ossman@cendio.se> for Cendio AB
+ * Copyright 2011-2014 Pierre Ossman for Cendio AB
  * 
  * This is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -223,10 +223,12 @@
 
 void Viewport::imageRect(const rfb::Rect& r, void* pixels) {
   if (pixelTrans) {
+    rdr::U8* buffer;
+    int stride;
+    buffer = frameBuffer->getBufferRW(r, &stride);
     pixelTrans->translateRect(pixels, r.width(),
                               rfb::Rect(0, 0, r.width(), r.height()),
-                              frameBuffer->data, frameBuffer->getStride(),
-                              r.tl);
+                              buffer, stride, rfb::Point(0, 0));
   } else {
     frameBuffer->imageRect(r, pixels);
   }
@@ -348,6 +350,9 @@
   PlatformPixelBuffer* newBuffer;
   rfb::Rect rect;
 
+  const rdr::U8* data;
+  int stride;
+
   // FIXME: Resize should probably be a feature of the pixel buffer itself
 
   if ((w == frameBuffer->width()) && (h == frameBuffer->height()))
@@ -362,7 +367,8 @@
   rect.setXYWH(0, 0,
                __rfbmin(newBuffer->width(), frameBuffer->width()),
                __rfbmin(newBuffer->height(), frameBuffer->height()));
-  newBuffer->imageRect(rect, frameBuffer->data, frameBuffer->getStride());
+  data = frameBuffer->getBuffer(frameBuffer->getRect(), &stride);
+  newBuffer->imageRect(rect, data, stride);
 
   // Black out any new areas
 
diff --git a/win/rfb_win32/DeviceFrameBuffer.cxx b/win/rfb_win32/DeviceFrameBuffer.cxx
index 33b1be5..0ad06e9 100644
--- a/win/rfb_win32/DeviceFrameBuffer.cxx
+++ b/win/rfb_win32/DeviceFrameBuffer.cxx
@@ -1,4 +1,5 @@
 /* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
+ * Copyright 2014 Pierre Ossman for Cendio AB
  * 
  * This is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -141,6 +142,10 @@
 
   try {
 
+    const rdr::U8* buffer;
+    rdr::U8* rwbuffer;
+    int stride;
+
     // - Get the size and other details about the cursor.
 
     IconInfo iconInfo((HICON)hCursor);
@@ -192,6 +197,7 @@
 
     bool doOutline = false;
     if (!iconInfo.hbmColor) {
+      rwbuffer = cursorBm.getBufferRW(cursorBm.getRect(), &stride);
       Pixel xorColour = format.pixelFromRGB((rdr::U16)0, (rdr::U16)0, (rdr::U16)0);
       for (int y = 0; y < cursor.height(); y++) {
         for (int x = 0; x < cursor.width(); x++) {
@@ -203,11 +209,11 @@
 
             switch (format.bpp) {
             case 8:
-              ((rdr::U8*)cursorBm.data)[y * cursor.width() + x] = xorColour;  break;
+              rwbuffer[y * cursor.width() + x] = xorColour;  break;
             case 16:
-              ((rdr::U16*)cursorBm.data)[y * cursor.width() + x] = xorColour; break;
+              rwbuffer[y * cursor.width() + x] = xorColour; break;
             case 32:
-              ((rdr::U32*)cursorBm.data)[y * cursor.width() + x] = xorColour; break;
+              rwbuffer[y * cursor.width() + x] = xorColour; break;
             }
 
             doOutline = true;
@@ -229,13 +235,20 @@
 
     if (doOutline) {
       vlog.debug("drawing cursor outline!");
-      memcpy(cursor.data, cursorBm.data, cursor.dataLen());
+
+      buffer = cursorBm.getBuffer(cursorBm.getRect(), &stride);
+      cursor.imageRect(cursorBm.getRect(), buffer, stride);
+
       cursor.drawOutline(format.pixelFromRGB((rdr::U16)0xffff, (rdr::U16)0xffff, (rdr::U16)0xffff));
-      memcpy(cursorBm.data, cursor.data, cursor.dataLen());
+
+      buffer = cursor.getBuffer(cursor.getRect(), &stride);
+      cursorBm.imageRect(cursor.getRect(), buffer, stride);
     }
 
+    buffer = cursorBm.getBuffer(cursorBm.getRect(), &stride);
     server->setCursor(cursor.width(), cursor.height(), cursor.hotspot,
-                      cursorBm.data, cursor.mask.buf);
+                      buffer, cursor.mask.buf);
+
   } catch (rdr::Exception& e) {
     vlog.error("%s", e.str());
   }