whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix buffer overflow in text blending 

Clip buffers being converted to those being worked on so we don't write
outside the lines.

Task-number: QTBUG-61863
Change-Id: Icc7c6c0946fa522b5afeca0663fc2b45151b1897
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
bb10
Allan Sandfeld Jensen 2017-07-11 15:17:01 +02:00
parent 4970ef5574
commit 69c5ddf295
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/gui/painting/qdrawhelper.cpp
View File

@ -5625,13 +5625,13 @@ static void qt_alphamapblit_generic(QRasterBuffer *rasterBuffer,
int start = qMax<int>(x, clip.x);
int end = qMin<int>(x + mapWidth, clip.x + clip.len);
Q_ASSERT(clip.len <= buffer_size);
QRgba64 *dest = destFetch64((QRgba64*)buffer, rasterBuffer, start, clip.y, clip.len);
QRgba64 *dest = destFetch64((QRgba64*)buffer, rasterBuffer, start, clip.y, end - start);
for (int xp=start; xp<end; ++xp) {
const int coverage = map[xp - x];
alphamapblend_generic(coverage, dest, xp - start, srcColor, color, colorProfile);
}
destStore64(rasterBuffer, start, clip.y, dest, clip.len);
destStore64(rasterBuffer, start, clip.y, dest, end - start);
} // for (i -> line.count)
map += mapStride;
} // for (yp -> bottom)
@ -5898,13 +5898,13 @@ static void qt_alphargbblit_generic(QRasterBuffer *rasterBuffer,
int start = qMax<int>(x, clip.x);
int end = qMin<int>(x + mapWidth, clip.x + clip.len);
Q_ASSERT(clip.len <= buffer_size);
QRgba64 *dest = destFetch64((QRgba64*)buffer, rasterBuffer, start, clip.y, clip.len);
QRgba64 *dest = destFetch64((QRgba64*)buffer, rasterBuffer, start, clip.y, end - start);
for (int xp=start; xp<end; ++xp) {
const uint coverage = src[xp - x];
alphargbblend_generic(coverage, dest, xp - start, srcColor, color, colorProfile);
}
destStore64(rasterBuffer, start, clip.y, dest, clip.len);
destStore64(rasterBuffer, start, clip.y, dest, end - start);
} // for (i -> line.count)
src += srcStride;
} // for (yp -> bottom)