fdo-mirrors/cairo
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/cairo/cairo.git synced 2026-01-13 10:50:28 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

image: Fix crash in _fill_xrgb32_lerp_opaque_spans

Browse source 
If a span length is negative don't go out of bounds processing the fill
data.

Patch thanks to Ilya Sakhnenko <ilia.softway@gmail.com> on mailing list.

Signed-off-by: Bryce Harrington <bryce@osg.samsung.com>
This commit is contained in:
Bryce Harrington 2014-12-03 19:28:15 -08:00
parent 56da7adc3c
commit 5c82d91a5e
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/cairo-image-compositor.c
View file

@ -2242,10 +2242,10 @@ _fill_xrgb32_lerp_opaque_spans (void *abstract_renderer, int y, int h,
spans[0].x, y, len, 1, r->u.fill.pixel);
} else {
uint32_t *d = (uint32_t*)(r->u.fill.data + r->u.fill.stride*y + spans[0].x*4);
while (len--)
while (len-- > 0)
*d++ = r->u.fill.pixel;
}
} else while (len--) {
} else while (len-- > 0) {
*d = lerp8x4 (r->u.fill.pixel, a, *d);
d++;
}