Commit 8122f6d6 authored by Marek Kasik's avatar Marek Kasik Committed by Albert Astals Cid
Browse files

cairo: Constrain number of cycles in rescale filter

Pass address of the first byte after end of the source buffer
to downsample_row_box_filter() so that we can check
that we don't run out of it.

Fixes issue #736
parent d716e636
Pipeline #26842 passed with stages
in 13 minutes and 25 seconds
......@@ -62,7 +62,7 @@
static void downsample_row_box_filter (
int start, int width,
uint32_t *src, uint32_t *dest,
uint32_t *src, uint32_t *src_limit, uint32_t *dest,
int coverage[], int pixel_coverage)
{
/* we need an array of the pixel contribution of each destination pixel on the boundaries.
......@@ -90,13 +90,13 @@ static void downsample_row_box_filter (
/* skip to start */
/* XXX: it might be possible to do this directly instead of iteratively, however
* the iterative solution is simple */
while (x < start)
while (x < start && src < src_limit)
{
int box = 1 << FIXED_SHIFT;
int start_coverage = coverage[x];
box -= start_coverage;
src++;
while (box >= pixel_coverage)
while (box >= pixel_coverage && src < src_limit)
{
src++;
box -= pixel_coverage;
......@@ -104,7 +104,7 @@ static void downsample_row_box_filter (
x++;
}
while (x < start + width)
while (x < start + width && src < src_limit)
{
uint32_t a = 0;
uint32_t r = 0;
......@@ -121,7 +121,7 @@ static void downsample_row_box_filter (
x++;
box -= start_coverage;
while (box >= pixel_coverage)
while (box >= pixel_coverage && src < src_limit)
{
a += ((*src >> 24) & 0xff) * pixel_coverage;
r += ((*src >> 16) & 0xff) * pixel_coverage;
......@@ -135,7 +135,7 @@ static void downsample_row_box_filter (
/* multiply by whatever is leftover
* this ensures that we don't bias down.
* i.e. start_coverage + n*pixel_coverage + box == 1 << 24 */
if (box > 0)
if (box > 0 && src < src_limit)
{
a += ((*src >> 24) & 0xff) * box;
r += ((*src >> 16) & 0xff) * box;
......@@ -337,7 +337,7 @@ bool CairoRescaleBox::downScaleImage(unsigned orig_width, unsigned orig_height,
int start_coverage_y = y_coverage[dest_y];
getRow(src_y, scanline);
downsample_row_box_filter (start_column, width, scanline, temp_buf + width * columns, x_coverage, pixel_coverage_x);
downsample_row_box_filter (start_column, width, scanline, scanline + orig_width, temp_buf + width * columns, x_coverage, pixel_coverage_x);
columns++;
src_y++;
box -= start_coverage_y;
......@@ -345,7 +345,7 @@ bool CairoRescaleBox::downScaleImage(unsigned orig_width, unsigned orig_height,
while (box >= pixel_coverage_y)
{
getRow(src_y, scanline);
downsample_row_box_filter (start_column, width, scanline, temp_buf + width * columns, x_coverage, pixel_coverage_x);
downsample_row_box_filter (start_column, width, scanline, scanline + orig_width, temp_buf + width * columns, x_coverage, pixel_coverage_x);
columns++;
src_y++;
box -= pixel_coverage_y;
......@@ -355,7 +355,7 @@ bool CairoRescaleBox::downScaleImage(unsigned orig_width, unsigned orig_height,
if (box > 0)
{
getRow(src_y, scanline);
downsample_row_box_filter (start_column, width, scanline, temp_buf + width * columns, x_coverage, pixel_coverage_x);
downsample_row_box_filter (start_column, width, scanline, scanline + orig_width, temp_buf + width * columns, x_coverage, pixel_coverage_x);
columns++;
}
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment