From 3666574f881a9801fe5af675de0e3bb3cb8afc54 Mon Sep 17 00:00:00 2001 From: JunsuChoi Date: Thu, 18 Mar 2021 17:10:05 +0900 Subject: ector image: Prevents drawing images outside buffer Summary: A crash may occur when image size is set larger than buffer. So, modify boundary of the image drawing the image so that it does not go out of the buffer. Test Plan: N/A Reviewers: Hermet Reviewed By: Hermet Subscribers: cedric, #reviewers, #committers, kimcinoo Tags: #efl Differential Revision: https://phab.enlightenment.org/D12251 --- src/lib/ector/software/ector_renderer_software_image.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/lib/ector/software/ector_renderer_software_image.c b/src/lib/ector/software/ector_renderer_software_image.c index f933bd6a00..d7807ed518 100644 --- a/src/lib/ector/software/ector_renderer_software_image.c +++ b/src/lib/ector/software/ector_renderer_software_image.c @@ -106,6 +106,10 @@ _ector_renderer_software_image_ector_renderer_draw(Eo *obj EINA_UNUSED, double im11, im12, im21, im22, im31, im32; uint32_t *dst_buf, *src_buf; int image_w, image_h; + + int dst_buf_width = MIN(pd->boundary.x2, (int)pd->surface->rasterizer->fill_data.raster_buffer->generic->w); + int dst_buf_height = MIN(pd->boundary.y2, (int)pd->surface->rasterizer->fill_data.raster_buffer->generic->h); + ector_buffer_size_get(pd->image->buffer, &image_w, &image_h); dst_buf = pd->surface->rasterizer->fill_data.raster_buffer->pixels.u32; @@ -116,9 +120,9 @@ _ector_renderer_software_image_ector_renderer_draw(Eo *obj EINA_UNUSED, &im31, &im32, NULL); //Draw - for (int local_y = pd->boundary.y1; local_y < pd->boundary.y2; local_y++) + for (int local_y = pd->boundary.y1; local_y < dst_buf_height; local_y++) { - for (int local_x = pd->boundary.x1; local_x < pd->boundary.x2; local_x++) + for (int local_x = pd->boundary.x1; local_x < dst_buf_width; local_x++) { uint32_t *dst = dst_buf + ((int)local_x + ((int)local_y * pix_stride)); int rx, ry; -- cgit v1.2.1