Aren/haiku
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

* agg::rendering_buffer::row_ptr() crashes when passing an out of bounds index.

Browse Source 
* This fixes bug #2316.


git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@29860 a95241bf-73f2-0310-859d-f6bbb57e9c96
This commit is contained in:
Axel Dörfler 2009-04-02 09:04:00 +00:00
parent 65e2393c21
commit 969f8de530
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/servers/app/drawing/Painter/Painter.cpp
View File

@ -464,6 +464,9 @@ Painter::StraightLine(BPoint a, BPoint b, const rgb_color& c) const
if (a.y == b.y) { if (a.y == b.y) {
// horizontal // horizontal
int32 y = (int32)a.y; int32 y = (int32)a.y;
if (y < 0 || y >= fBuffer.height())
return true;
uint8* dst = fBuffer.row_ptr(y); uint8* dst = fBuffer.row_ptr(y);
int32 x1 = (int32)min_c(a.x, b.x); int32 x1 = (int32)min_c(a.x, b.x);
int32 x2 = (int32)max_c(a.x, b.x); int32 x2 = (int32)max_c(a.x, b.x);
@ -982,7 +985,8 @@ Painter::FillRectVerticalGradient(BRect r,
// for (int32 x = x1; x <= x2; x++) { // for (int32 x = x1; x <= x2; x++) {
// *handle++ = gradientArray[y1 - top]; // *handle++ = gradientArray[y1 - top];
// } // }
gfxset32(offset + y1 * bpr, gradientArray[y1 - top], (x2 - x1 + 1) * 4); gfxset32(offset + y1 * bpr, gradientArray[y1 - top],
(x2 - x1 + 1) * 4);
} }
} }
} while (fBaseRenderer.next_clip_box()); } while (fBaseRenderer.next_clip_box());
@ -1010,7 +1014,7 @@ Painter::FillRectNoClipping(const clipping_rect& r, const rgb_color& c) const
// for (int32 x = left; x <= right; x++) { // for (int32 x = left; x <= right; x++) {
// *handle++ = color.data32; // *handle++ = color.data32;
// } // }
gfxset32(dst, color.data32, bytes); gfxset32(dst, color.data32, bytes);
dst += bpr; dst += bpr;
} }
} }