git_clone/thorvg
1
0
Fork 0
mirror of https://github.com/thorvg/thorvg.git synced 2025-06-12 07:32:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

sw_engine rle: The out-of-range memory access has been fixed.

Browse source 
@Issue: https://github.com/thorvg/thorvg/issues/1370
This commit is contained in:
Hermet Park 2023-04-24 18:06:26 +09:00
parent 7e3380db8b
commit 20466ea78f
1 changed files with 8 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
src/lib/sw_engine/tvgSwRle.cpp
View file

@ -773,7 +773,7 @@ static int _genRle(RleWorker& rw)
} }
static SwSpan* _intersectSpansRegion(const SwRleData *clip, const SwRleData *target, SwSpan *outSpans) static SwSpan* _intersectSpansRegion(const SwRleData *clip, const SwRleData *target, SwSpan *outSpans, uint32_t outSpansCnt)
{ {
auto out = outSpans; auto out = outSpans;
auto spans = target->spans; auto spans = target->spans;
@ -794,7 +794,7 @@ static SwSpan* _intersectSpansRegion(const SwRleData *clip, const SwRleData *tar
//Try clipping with all clip spans which have a same y coordinate. //Try clipping with all clip spans which have a same y coordinate.
auto temp = clipSpans; auto temp = clipSpans;
while(temp->y == clipSpans->y) { while(temp < clipEnd && outSpansCnt > 0 && temp->y == clipSpans->y) {
auto sx1 = spans->x; auto sx1 = spans->x;
auto sx2 = sx1 + spans->len; auto sx2 = sx1 + spans->len;
auto cx1 = temp->x; auto cx1 = temp->x;
@ -815,6 +815,7 @@ static SwSpan* _intersectSpansRegion(const SwRleData *clip, const SwRleData *tar
out->len = len; out->len = len;
out->coverage = (uint8_t)(((spans->coverage * temp->coverage) + 0xff) >> 8); out->coverage = (uint8_t)(((spans->coverage * temp->coverage) + 0xff) >> 8);
++out; ++out;
--outSpansCnt;
} }
++temp; ++temp;
} }
@ -824,7 +825,7 @@ static SwSpan* _intersectSpansRegion(const SwRleData *clip, const SwRleData *tar
} }
static SwSpan* _intersectSpansRect(const SwBBox *bbox, const SwRleData *targetRle, SwSpan *outSpans, uint32_t spanCnt) static SwSpan* _intersectSpansRect(const SwBBox *bbox, const SwRleData *targetRle, SwSpan *outSpans, uint32_t outSpansCnt)
{ {
auto out = outSpans; auto out = outSpans;
auto spans = targetRle->spans; auto spans = targetRle->spans;
@ -834,7 +835,7 @@ static SwSpan* _intersectSpansRect(const SwBBox *bbox, const SwRleData *targetRl
auto maxx = minx + static_cast<int16_t>(bbox->max.x - bbox->min.x) - 1; auto maxx = minx + static_cast<int16_t>(bbox->max.x - bbox->min.x) - 1;
auto maxy = miny + static_cast<int16_t>(bbox->max.y - bbox->min.y) - 1; auto maxy = miny + static_cast<int16_t>(bbox->max.y - bbox->min.y) - 1;
while (spanCnt && spans < end) { while (outSpansCnt > 0 && spans < end) {
if (spans->y > maxy) { if (spans->y > maxy) {
spans = end; spans = end;
break; break;
@ -851,13 +852,13 @@ static SwSpan* _intersectSpansRect(const SwBBox *bbox, const SwRleData *targetRl
out->x = spans->x; out->x = spans->x;
out->len = spans->len < (maxx - spans->x + 1) ? spans->len : (maxx - spans->x + 1); out->len = spans->len < (maxx - spans->x + 1) ? spans->len : (maxx - spans->x + 1);
} }
if (out->len != 0) { if (out->len > 0) {
out->y = spans->y; out->y = spans->y;
out->coverage = spans->coverage; out->coverage = spans->coverage;
++out; ++out;
--outSpansCnt;
} }
++spans; ++spans;
--spanCnt;
} }
return out; return out;
} }
@ -1120,7 +1121,7 @@ void rleClipPath(SwRleData *rle, const SwRleData *clip)
if (rle->size == 0 || clip->size == 0) return; if (rle->size == 0 || clip->size == 0) return;
auto spanCnt = rle->size > clip->size ? rle->size : clip->size; auto spanCnt = rle->size > clip->size ? rle->size : clip->size;
auto spans = static_cast<SwSpan*>(malloc(sizeof(SwSpan) * (spanCnt))); auto spans = static_cast<SwSpan*>(malloc(sizeof(SwSpan) * (spanCnt)));
auto spansEnd = _intersectSpansRegion(clip, rle, spans); auto spansEnd = _intersectSpansRegion(clip, rle, spans, spanCnt);
_replaceClipSpan(rle, spans, spansEnd - spans); _replaceClipSpan(rle, spans, spansEnd - spans);