From 622b25a3b4b139b7a5b1f67a816cfb02763cd783 Mon Sep 17 00:00:00 2001 From: Hermet Park Date: Wed, 3 Apr 2024 16:02:07 +0900 Subject: [PATCH] lottie: hotfix memory corruption. revise the fix that occured a side effect by: 287e6d33d2c2fbd913c75cb0bc257a977c910b99 --- src/loaders/lottie/tvgLottieModel.h | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/src/loaders/lottie/tvgLottieModel.h b/src/loaders/lottie/tvgLottieModel.h index 7a9c99f9..71df32a8 100644 --- a/src/loaders/lottie/tvgLottieModel.h +++ b/src/loaders/lottie/tvgLottieModel.h @@ -383,10 +383,7 @@ struct LottieGradient : LottieObject uint32_t populate(ColorStop& color) { colorStops.populated = true; - if (!color.input || color.input->count % 4 != 0) { - TVGERR("LOTTIE", "The given colorstop value is not correct!"); - return 0; - } + if (!color.input) return 0; uint32_t alphaCnt = (color.input->count - (colorStops.count * 4)) / 2; Array output(colorStops.count + alphaCnt); @@ -434,7 +431,7 @@ struct LottieGradient : LottieObject } //color remains - while (cidx < clast) { + while (cidx + 3 < clast) { cs.offset = (*color.input)[cidx]; cs.r = lroundf((*color.input)[cidx + 1] * 255.0f); cs.g = lroundf((*color.input)[cidx + 2] * 255.0f);