fdo-mirrors/cairo
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/cairo/cairo.git synced 2026-05-03 18:18:08 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

image: Fix crash in _fill_xrgb32_lerp_opaque_spans

Browse source 
If a span length is negative don't go out of bounds processing the fill
data.

Patch thanks to Ilya Sakhnenko <ilia.softway@gmail.com> on mailing list.

Signed-off-by: Bryce Harrington <bryce@osg.samsung.com>
This commit is contained in:
Bryce Harrington 2014-12-03 19:28:15 -08:00
parent 56da7adc3c
commit 5c82d91a5e
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/cairo-image-compositor.c
View file

@ -2242,10 +2242,10 @@ _fill_xrgb32_lerp_opaque_spans (void *abstract_renderer, int y, int h,
spans[0].x, y, len, 1, r->u.fill.pixel); spans[0].x, y, len, 1, r->u.fill.pixel);
} else { } else {
uint32_t *d = (uint32_t*)(r->u.fill.data + r->u.fill.stride*y + spans[0].x*4); uint32_t *d = (uint32_t*)(r->u.fill.data + r->u.fill.stride*y + spans[0].x*4);
while (len--) while (len-- > 0)
*d++ = r->u.fill.pixel; *d++ = r->u.fill.pixel;
} }
} else while (len--) { } else while (len-- > 0) {
*d = lerp8x4 (r->u.fill.pixel, a, *d); *d = lerp8x4 (r->u.fill.pixel, a, *d);
d++; d++;
} }