diff options
author | Adam Jackson <ajax@redhat.com> | 2020-03-26 18:08:17 -0400 |
---|---|---|
committer | Adam Jackson <ajax@nwnk.net> | 2020-04-02 14:58:52 +0000 |
commit | 348e99b52f41caf32f8b7840e53f0b1322716c47 (patch) | |
tree | 7f63c0edd06db7aff014b2ac2b8e7f29ff040786 | |
parent | ba5d794515fa3ea91dd4ea9222a23c2642070aed (diff) | |
download | pixman-348e99b52f41caf32f8b7840e53f0b1322716c47.tar.gz |
fast-path: Fix some sketchy pointer arithmetic
We want a uint8_t * at the end of this math, because that's what the
function we're about to pass it to takes. But ->bits is a uint32_t, so
if we just do the math in units of that we can avoid the explicit factor
of four which would risk an integer overflow.
Fixes: pixman/pixman#14
-rw-r--r-- | pixman/pixman-fast-path.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/pixman/pixman-fast-path.c b/pixman/pixman-fast-path.c index 1ba779b..4b7a6f8 100644 --- a/pixman/pixman-fast-path.c +++ b/pixman/pixman-fast-path.c @@ -2800,7 +2800,7 @@ bits_image_fetch_separable_convolution_affine (pixman_image_t * image, repeat (repeat_mode, &rx, bits->width); repeat (repeat_mode, &ry, bits->height); - row = (uint8_t *)bits->bits + bits->rowstride * 4 * ry; + row = (uint8_t *)(bits->bits + bits->rowstride * ry); pixel = convert_pixel (row, rx) | mask; } else @@ -2811,7 +2811,7 @@ bits_image_fetch_separable_convolution_affine (pixman_image_t * image, } else { - row = (uint8_t *)bits->bits + bits->rowstride * 4 * ry; + row = (uint8_t *)(bits->bits + bits->rowstride * ry); pixel = convert_pixel (row, rx) | mask; } } @@ -2913,8 +2913,8 @@ bits_image_fetch_bilinear_affine (pixman_image_t * image, repeat (repeat_mode, &x2, width); repeat (repeat_mode, &y2, height); - row1 = (uint8_t *)bits->bits + bits->rowstride * 4 * y1; - row2 = (uint8_t *)bits->bits + bits->rowstride * 4 * y2; + row1 = (uint8_t *)(bits->bits + bits->rowstride * y1); + row2 = (uint8_t *)(bits->bits + bits->rowstride * y2); tl = convert_pixel (row1, x1) | mask; tr = convert_pixel (row1, x2) | mask; @@ -2949,7 +2949,7 @@ bits_image_fetch_bilinear_affine (pixman_image_t * image, } else { - row1 = (uint8_t *)bits->bits + bits->rowstride * 4 * y1; + row1 = (uint8_t *)(bits->bits + bits->rowstride * y1); row1 += bpp / 8 * x1; mask1 = PIXMAN_FORMAT_A (format)? 0 : 0xff000000; @@ -2962,7 +2962,7 @@ bits_image_fetch_bilinear_affine (pixman_image_t * image, } else { - row2 = (uint8_t *)bits->bits + bits->rowstride * 4 * y2; + row2 = (uint8_t *)(bits->bits + bits->rowstride * y2); row2 += bpp / 8 * x1; mask2 = PIXMAN_FORMAT_A (format)? 0 : 0xff000000; @@ -3060,7 +3060,7 @@ bits_image_fetch_nearest_affine (pixman_image_t * image, repeat (repeat_mode, &y0, height); } - row = (uint8_t *)bits->bits + bits->rowstride * 4 * y0; + row = (uint8_t *)(bits->bits + bits->rowstride * y0); buffer[i] = convert_pixel (row, x0) | mask; } |