git_clone/thorvg
1
0
Fork 0
mirror of https://github.com/thorvg/thorvg.git synced 2025-06-13 19:44:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

loader/lottie: fix a crash issue caused by incorrect gradient alpha handling.

Browse source 
This fix addresses the interpretation of gradient alpha values,
preventing a potential crash due to invalid memory access.
This commit is contained in:
Hermet Park 2023-08-30 15:49:21 +09:00
parent 735c1cb9e4
commit ce5ac1c114
3 changed files with 14 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
src/examples/images/27746-joypixels-partying-face-emoji-animation.json Normal file
View file

File diff suppressed because one or more lines are too long

13
src/loaders/lottie/tvgLottieParser.cpp
View file

@ -240,11 +240,12 @@ void LottieParser::getValue(ColorStop& color)
auto count = context->gradient->colorStops.count;
if (!color.data) color.data = static_cast<Fill::ColorStop*>(malloc(sizeof(Fill::ColorStop) * count));
//rgb
while (nextArrayValue()) {
auto remains = (idx % 4);
if (remains == 0) {
color.data[idx / 4].offset = getFloat();
color.data[idx / 4].a = 255; //Not used.
color.data[idx / 4].a = 255; //in default
} else if (remains == 1) {
color.data[idx / 4].r = lroundf(getFloat() * 255.0f);
} else if (remains == 2) {
@ -252,7 +253,15 @@ void LottieParser::getValue(ColorStop& color)
} else if (remains == 3) {
color.data[idx / 4].b = lroundf(getFloat() * 255.0f);
}
++idx;
if ((++idx / 4) == count) break;
}
//alpha
idx = 0;
while (nextArrayValue()) {
auto offset = getFloat(); //not used for now.
if (!mathEqual(offset, color.data[idx].offset)) TVGERR("LOTTIE", "FIXME: Gradient alpha offset is ignored");
color.data[idx++].a = lroundf(getFloat() * 255.0f);
}
}

3
src/loaders/lottie/tvgLottieProperty.h
View file

@ -388,7 +388,8 @@ struct LottieColorStop
auto r = mathLerp(s->r, e->r, t);
auto g = mathLerp(s->g, e->g, t);
auto b = mathLerp(s->b, e->b, t);
result.push({offset, r, g, b, 255});
auto a = mathLerp(s->a, e->a, t);
result.push({offset, r, g, b, a});
}
fill->colorStops(result.data, count);
}