i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

app_server: bitmap interpolation; fix out-of-bounds access

Browse Source 
* Optimized code path for bitmap drawing with bilinear interpolation
  scaling was assuming that source bitmap is always at least 2 rows
  in size.

* Fixes #12469: in webkit, scaled 1-pixel-high bitmaps often occur.
  If the bitmap allocation is by chance aligned to a page end, access
  to the non-existant second row crashes app_server.
This commit is contained in:
Julian Harnath
2015-11-18 14:40:17 +01:00
parent 345d9bb4a2
commit 718f352859
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/servers/app/drawing/Painter/bitmap_painter/DrawBitmapBilinear.h
+6 -1
View File
@@ -266,12 +266,17 @@ struct BilinearDefault :
const uint16 wRight = 255 - wLeft; const uint16 wRight = 255 - wLeft;
uint32 t[4]; uint32 t[4];
if (fSource->height() > 1) {
ColorType::Interpolate(&t[0], s, this->fSourceBytesPerRow, ColorType::Interpolate(&t[0], s, this->fSourceBytesPerRow,
wLeft, wTop, wRight, wBottom); wLeft, wTop, wRight, wBottom);
} else {
ColorType::InterpolateLastRow(&t[0], s, wLeft, wRight);
}
DrawMode::Blend(d, &t[0]); DrawMode::Blend(d, &t[0]);
} }
// last column of pixels if necessary // last column of pixels if necessary
if (xIndexMax < xIndexR) { if (xIndexMax < xIndexR && fSource->height() > 1) {
const uint8* s = src + this->fWeightsX[xIndexR].index; const uint8* s = src + this->fWeightsX[xIndexR].index;
const uint8* sBottom = s + this->fSourceBytesPerRow; const uint8* sBottom = s + this->fSourceBytesPerRow;