diff options
| author | Matthias Clasen <mclasen@redhat.com> | 2015-08-24 15:20:08 -0400 |
|---|---|---|
| committer | Matthias Clasen <mclasen@redhat.com> | 2015-08-24 16:27:16 -0400 |
| commit | ca3c56421c075e729750cf80c3438b283232cce8 (patch) | |
| tree | d474bfb34c84eaa8ddeac4728790a07265b1796e /gdk-pixbuf/gdk-pixbuf-util.c | |
| parent | e4eaa11b0ac28960ab0696085d49104166c9a5b2 (diff) | |
| download | gdk-pixbuf-ca3c56421c075e729750cf80c3438b283232cce8.tar.gz | |
Avoid integer overflow in gdk_pixbuf_add_alpha
Same as before: don't do ptr = base + y * rowstride if y and
rowstride are integers.
This should fix http://bugzilla.gnome/org/753569
Diffstat (limited to 'gdk-pixbuf/gdk-pixbuf-util.c')
| -rw-r--r-- | gdk-pixbuf/gdk-pixbuf-util.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/gdk-pixbuf/gdk-pixbuf-util.c b/gdk-pixbuf/gdk-pixbuf-util.c index 6abe9b97e..3600450e9 100644 --- a/gdk-pixbuf/gdk-pixbuf-util.c +++ b/gdk-pixbuf/gdk-pixbuf-util.c @@ -67,6 +67,8 @@ gdk_pixbuf_add_alpha (const GdkPixbuf *pixbuf, int x, y; const guint8 *src_pixels; guint8 *ret_pixels; + const guchar *src; + guchar *dest; g_return_val_if_fail (GDK_IS_PIXBUF (pixbuf), NULL); g_return_val_if_fail (pixbuf->colorspace == GDK_COLORSPACE_RGB, NULL); @@ -85,20 +87,18 @@ gdk_pixbuf_add_alpha (const GdkPixbuf *pixbuf, } else { new_pixbuf = gdk_pixbuf_new (GDK_COLORSPACE_RGB, TRUE, 8, pixbuf->width, pixbuf->height); } - + if (!new_pixbuf) return NULL; ret_pixels = gdk_pixbuf_get_pixels (new_pixbuf); - for (y = 0; y < pixbuf->height; y++) { - const guchar *src; - guchar *dest; + for (y = 0; y < pixbuf->height; y++, src_pixels += pixbuf->rowstride, ret_pixels += new_pixbuf->rowstride) { guchar tr, tg, tb; - src = src_pixels + y * pixbuf->rowstride; - dest = ret_pixels + y * new_pixbuf->rowstride; - + src = src_pixels; + dest = ret_pixels; + if (pixbuf->has_alpha) { /* Just subst color, we already copied everything else */ for (x = 0; x < pixbuf->width; x++) { @@ -107,12 +107,12 @@ gdk_pixbuf_add_alpha (const GdkPixbuf *pixbuf, src += 4; dest += 4; } - } else { + } else { for (x = 0; x < pixbuf->width; x++) { tr = *dest++ = *src++; tg = *dest++ = *src++; tb = *dest++ = *src++; - + if (substitute_color && tr == r && tg == g && tb == b) *dest++ = 0; else |