From b9bc6c31a0987143cfedee7041d542b26a726966 Mon Sep 17 00:00:00 2001 From: Allan Sandfeld Jensen Date: Tue, 22 May 2018 16:57:13 +0200 Subject: Fix potential 16-bit integer overflow When multiplying a float in [0;1[ with (1<<16), with rounding, it might end up being rounded to 65536 even if the input was under 1. This patch uses a floor operation to make sure the value can be in a ushort, and cleans up the surrounding code so it is clearer what it does. Task-number: QTBUG-68360 Change-Id: I2d566586765db3d68e8e7e5fb2fd1df20dabd922 Reviewed-by: Eirik Aavitsland --- src/gui/painting/qdrawhelper.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'src/gui/painting') diff --git a/src/gui/painting/qdrawhelper.cpp b/src/gui/painting/qdrawhelper.cpp index f3df62b855..17010fa3fa 100644 --- a/src/gui/painting/qdrawhelper.cpp +++ b/src/gui/painting/qdrawhelper.cpp @@ -3193,13 +3193,13 @@ static const QRgba64 *QT_FASTCALL fetchTransformedBilinear64(QRgba64 *buffer, co const qreal px = fx * iw - qreal(0.5); const qreal py = fy * iw - qreal(0.5); - int x1 = int(px) - (px < 0); + int x1 = qFloor(px); int x2; - int y1 = int(py) - (py < 0); + int y1 = qFloor(py); int y2; - distxs[i] = int((px - x1) * (1<<16)); - distys[i] = int((py - y1) * (1<<16)); + distxs[i] = qFloor((px - x1) * (1<<16)); + distys[i] = qFloor((py - y1) * (1<<16)); fetchTransformedBilinear_pixelBounds(image.width, image.x1, image.x2 - 1, x1, x2); fetchTransformedBilinear_pixelBounds(image.height, image.y1, image.y2 - 1, y1, y2); -- cgit v1.2.3