diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2012-04-28 23:15:52 +0100 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2012-04-28 23:16:32 +0100 |
| commit | ec400daf9ec3bbd8403324db7fcdaf175e185e7b (patch) | |
| tree | 00de4e56d69913dc4777cc369453178b6e6ccf6a /src/cairo-image-compositor.c | |
| parent | a18506acf0ca4a5b6f56cc9a8e0ffb3dd0eaabab (diff) | |
| download | cairo-ec400daf9ec3bbd8403324db7fcdaf175e185e7b.tar.gz | |
image: Avoid overflow when computing lerp spans for a8
Reported-by: Benjamin Otte <otte@redhat.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Diffstat (limited to 'src/cairo-image-compositor.c')
| -rw-r--r-- | src/cairo-image-compositor.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/src/cairo-image-compositor.c b/src/cairo-image-compositor.c index f9ef03161..fb4b2fba5 100644 --- a/src/cairo-image-compositor.c +++ b/src/cairo-image-compositor.c @@ -1950,12 +1950,12 @@ _fill_a8_lerp_opaque_spans (void *abstract_renderer, int y, int h, if (a == 0xff) { memset(d + spans[0].x, r->u.fill.pixel, len); } else { - uint16_t p = (uint16_t)a * r->u.fill.pixel + 0x7f; - uint16_t ia = ~a; + uint8_t s = mul8_8(a, r->u.fill.pixel); uint8_t *dst = d + spans[0].x; + a = ~a; while (len--) { - uint16_t t = *dst*ia + p; - *dst++ = (t + (t>>8)) >> 8; + uint8_t t = mul8_8(*dst, a); + *dst++ = t + s; } } } @@ -1974,14 +1974,14 @@ _fill_a8_lerp_opaque_spans (void *abstract_renderer, int y, int h, yy++; } while (--hh); } else { - uint16_t p = (uint16_t)a * r->u.fill.pixel + 0x7f; - uint16_t ia = ~a; + uint8_t s = mul8_8(a, r->u.fill.pixel); + a = ~a; do { int len = spans[1].x - spans[0].x; uint8_t *d = r->u.fill.data + r->u.fill.stride*yy + spans[0].x; while (len--) { - uint16_t t = *d*ia + p; - *d++ = (t + (t>>8)) >> 8; + uint8_t t = mul8_8(*d, a); + *d++ = t + s; } yy++; } while (--hh); |