diff options
| author | Bryce Harrington <bryce@osg.samsung.com> | 2014-12-03 19:28:15 -0800 |
|---|---|---|
| committer | Bryce Harrington <bryce@osg.samsung.com> | 2014-12-05 19:16:43 -0800 |
| commit | 5c82d91a5e15d29b1489dcb413b24ee7fdf59934 (patch) | |
| tree | e2732765a8fbfedabe43623189ef0a64ef8b049e /src/cairo-image-compositor.c | |
| parent | 56da7adc3c85be0325481ecd23746dc49e60d239 (diff) | |
| download | cairo-5c82d91a5e15d29b1489dcb413b24ee7fdf59934.tar.gz | |
image: Fix crash in _fill_xrgb32_lerp_opaque_spans
If a span length is negative don't go out of bounds processing the fill
data.
Patch thanks to Ilya Sakhnenko <ilia.softway@gmail.com> on mailing list.
Signed-off-by: Bryce Harrington <bryce@osg.samsung.com>
Diffstat (limited to 'src/cairo-image-compositor.c')
| -rw-r--r-- | src/cairo-image-compositor.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/cairo-image-compositor.c b/src/cairo-image-compositor.c index 6ff0f09c0..48072f81b 100644 --- a/src/cairo-image-compositor.c +++ b/src/cairo-image-compositor.c @@ -2242,10 +2242,10 @@ _fill_xrgb32_lerp_opaque_spans (void *abstract_renderer, int y, int h, spans[0].x, y, len, 1, r->u.fill.pixel); } else { uint32_t *d = (uint32_t*)(r->u.fill.data + r->u.fill.stride*y + spans[0].x*4); - while (len--) + while (len-- > 0) *d++ = r->u.fill.pixel; } - } else while (len--) { + } else while (len-- > 0) { *d = lerp8x4 (r->u.fill.pixel, a, *d); d++; } |