diff options
author | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2017-07-11 15:17:01 +0200 |
---|---|---|
committer | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2017-07-11 18:13:25 +0000 |
commit | 69c5ddf29570172c1207b54d545a14446c8044a4 (patch) | |
tree | fc10d725237cadeab04749e096e6912a5fb339aa | |
parent | 4970ef5574017e88bf656a5aaa8a35920c71e405 (diff) |
Fix buffer overflow in text blending
Clip buffers being converted to those being worked on so we don't write
outside the lines.
Task-number: QTBUG-61863
Change-Id: Icc7c6c0946fa522b5afeca0663fc2b45151b1897
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
-rw-r--r-- | src/gui/painting/qdrawhelper.cpp | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/gui/painting/qdrawhelper.cpp b/src/gui/painting/qdrawhelper.cpp index 82aceb93c7..aca31cf3e8 100644 --- a/src/gui/painting/qdrawhelper.cpp +++ b/src/gui/painting/qdrawhelper.cpp @@ -5625,13 +5625,13 @@ static void qt_alphamapblit_generic(QRasterBuffer *rasterBuffer, int start = qMax<int>(x, clip.x); int end = qMin<int>(x + mapWidth, clip.x + clip.len); Q_ASSERT(clip.len <= buffer_size); - QRgba64 *dest = destFetch64((QRgba64*)buffer, rasterBuffer, start, clip.y, clip.len); + QRgba64 *dest = destFetch64((QRgba64*)buffer, rasterBuffer, start, clip.y, end - start); for (int xp=start; xp<end; ++xp) { const int coverage = map[xp - x]; alphamapblend_generic(coverage, dest, xp - start, srcColor, color, colorProfile); } - destStore64(rasterBuffer, start, clip.y, dest, clip.len); + destStore64(rasterBuffer, start, clip.y, dest, end - start); } // for (i -> line.count) map += mapStride; } // for (yp -> bottom) @@ -5898,13 +5898,13 @@ static void qt_alphargbblit_generic(QRasterBuffer *rasterBuffer, int start = qMax<int>(x, clip.x); int end = qMin<int>(x + mapWidth, clip.x + clip.len); Q_ASSERT(clip.len <= buffer_size); - QRgba64 *dest = destFetch64((QRgba64*)buffer, rasterBuffer, start, clip.y, clip.len); + QRgba64 *dest = destFetch64((QRgba64*)buffer, rasterBuffer, start, clip.y, end - start); for (int xp=start; xp<end; ++xp) { const uint coverage = src[xp - x]; alphargbblend_generic(coverage, dest, xp - start, srcColor, color, colorProfile); } - destStore64(rasterBuffer, start, clip.y, dest, clip.len); + destStore64(rasterBuffer, start, clip.y, dest, end - start); } // for (i -> line.count) src += srcStride; } // for (yp -> bottom) |