fdo-mirrors/cairo
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/cairo/cairo.git synced 2026-03-07 04:00:31 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

image: Avoid overflow when computing lerp spans for a8

Browse source 
Reported-by: Benjamin Otte <otte@redhat.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
This commit is contained in:
Chris Wilson 2012-04-28 23:15:52 +01:00
parent a18506acf0
commit ec400daf9e
1 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/cairo-image-compositor.c
View file

@ -1950,12 +1950,12 @@ _fill_a8_lerp_opaque_spans (void *abstract_renderer, int y, int h,
if (a == 0xff) {
memset(d + spans[0].x, r->u.fill.pixel, len);
} else {
uint16_t p = (uint16_t)a * r->u.fill.pixel + 0x7f;
uint16_t ia = ~a;
uint8_t s = mul8_8(a, r->u.fill.pixel);
uint8_t *dst = d + spans[0].x;
a = ~a;
while (len--) {
uint16_t t = *dst*ia + p;
*dst++ = (t + (t>>8)) >> 8;
uint8_t t = mul8_8(*dst, a);
*dst++ = t + s;
}
}
}
@ -1974,14 +1974,14 @@ _fill_a8_lerp_opaque_spans (void *abstract_renderer, int y, int h,
yy++;
} while (--hh);
} else {
uint16_t p = (uint16_t)a * r->u.fill.pixel + 0x7f;
uint16_t ia = ~a;
uint8_t s = mul8_8(a, r->u.fill.pixel);
a = ~a;
do {
int len = spans[1].x - spans[0].x;
uint8_t *d = r->u.fill.data + r->u.fill.stride*yy + spans[0].x;
while (len--) {
uint16_t t = *d*ia + p;
*d++ = (t + (t>>8)) >> 8;
uint8_t t = mul8_8(*d, a);
*d++ = t + s;
}
yy++;
} while (--hh);