From 348e99b52f41caf32f8b7840e53f0b1322716c47 Mon Sep 17 00:00:00 2001 From: Adam Jackson Date: Thu, 26 Mar 2020 18:08:17 -0400 Subject: fast-path: Fix some sketchy pointer arithmetic We want a uint8_t * at the end of this math, because that's what the function we're about to pass it to takes. But ->bits is a uint32_t, so if we just do the math in units of that we can avoid the explicit factor of four which would risk an integer overflow. Fixes: pixman/pixman#14 --- pixman/pixman-fast-path.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pixman/pixman-fast-path.c b/pixman/pixman-fast-path.c index 1ba779b..4b7a6f8 100644 --- a/pixman/pixman-fast-path.c +++ b/pixman/pixman-fast-path.c @@ -2800,7 +2800,7 @@ bits_image_fetch_separable_convolution_affine (pixman_image_t * image, repeat (repeat_mode, &rx, bits->width); repeat (repeat_mode, &ry, bits->height); - row = (uint8_t *)bits->bits + bits->rowstride * 4 * ry; + row = (uint8_t *)(bits->bits + bits->rowstride * ry); pixel = convert_pixel (row, rx) | mask; } else @@ -2811,7 +2811,7 @@ bits_image_fetch_separable_convolution_affine (pixman_image_t * image, } else { - row = (uint8_t *)bits->bits + bits->rowstride * 4 * ry; + row = (uint8_t *)(bits->bits + bits->rowstride * ry); pixel = convert_pixel (row, rx) | mask; } } @@ -2913,8 +2913,8 @@ bits_image_fetch_bilinear_affine (pixman_image_t * image, repeat (repeat_mode, &x2, width); repeat (repeat_mode, &y2, height); - row1 = (uint8_t *)bits->bits + bits->rowstride * 4 * y1; - row2 = (uint8_t *)bits->bits + bits->rowstride * 4 * y2; + row1 = (uint8_t *)(bits->bits + bits->rowstride * y1); + row2 = (uint8_t *)(bits->bits + bits->rowstride * y2); tl = convert_pixel (row1, x1) | mask; tr = convert_pixel (row1, x2) | mask; @@ -2949,7 +2949,7 @@ bits_image_fetch_bilinear_affine (pixman_image_t * image, } else { - row1 = (uint8_t *)bits->bits + bits->rowstride * 4 * y1; + row1 = (uint8_t *)(bits->bits + bits->rowstride * y1); row1 += bpp / 8 * x1; mask1 = PIXMAN_FORMAT_A (format)? 0 : 0xff000000; @@ -2962,7 +2962,7 @@ bits_image_fetch_bilinear_affine (pixman_image_t * image, } else { - row2 = (uint8_t *)bits->bits + bits->rowstride * 4 * y2; + row2 = (uint8_t *)(bits->bits + bits->rowstride * y2); row2 += bpp / 8 * x1; mask2 = PIXMAN_FORMAT_A (format)? 0 : 0xff000000; @@ -3060,7 +3060,7 @@ bits_image_fetch_nearest_affine (pixman_image_t * image, repeat (repeat_mode, &y0, height); } - row = (uint8_t *)bits->bits + bits->rowstride * 4 * y0; + row = (uint8_t *)(bits->bits + bits->rowstride * y0); buffer[i] = convert_pixel (row, x0) | mask; } -- cgit v1.2.1