diff options
| author | JunsuChoi <jsuya.choi@samsung.com> | 2021-03-18 17:10:05 +0900 |
|---|---|---|
| committer | JunsuChoi <jsuya.choi@samsung.com> | 2021-03-18 17:10:05 +0900 |
| commit | 3666574f881a9801fe5af675de0e3bb3cb8afc54 (patch) | |
| tree | b197a25e102a5eb4f3d7a2e3bedbfdd8f231b627 | |
| parent | b9b2b722054f3bb5b3ce1e554aa2cefaf03e8091 (diff) | |
| download | efl-3666574f881a9801fe5af675de0e3bb3cb8afc54.tar.gz | |
ector image: Prevents drawing images outside buffer
Summary:
A crash may occur when image size is set larger than buffer.
So, modify boundary of the image drawing the image
so that it does not go out of the buffer.
Test Plan: N/A
Reviewers: Hermet
Reviewed By: Hermet
Subscribers: cedric, #reviewers, #committers, kimcinoo
Tags: #efl
Differential Revision: https://phab.enlightenment.org/D12251
| -rw-r--r-- | src/lib/ector/software/ector_renderer_software_image.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/lib/ector/software/ector_renderer_software_image.c b/src/lib/ector/software/ector_renderer_software_image.c index f933bd6a00..d7807ed518 100644 --- a/src/lib/ector/software/ector_renderer_software_image.c +++ b/src/lib/ector/software/ector_renderer_software_image.c @@ -106,6 +106,10 @@ _ector_renderer_software_image_ector_renderer_draw(Eo *obj EINA_UNUSED, double im11, im12, im21, im22, im31, im32; uint32_t *dst_buf, *src_buf; int image_w, image_h; + + int dst_buf_width = MIN(pd->boundary.x2, (int)pd->surface->rasterizer->fill_data.raster_buffer->generic->w); + int dst_buf_height = MIN(pd->boundary.y2, (int)pd->surface->rasterizer->fill_data.raster_buffer->generic->h); + ector_buffer_size_get(pd->image->buffer, &image_w, &image_h); dst_buf = pd->surface->rasterizer->fill_data.raster_buffer->pixels.u32; @@ -116,9 +120,9 @@ _ector_renderer_software_image_ector_renderer_draw(Eo *obj EINA_UNUSED, &im31, &im32, NULL); //Draw - for (int local_y = pd->boundary.y1; local_y < pd->boundary.y2; local_y++) + for (int local_y = pd->boundary.y1; local_y < dst_buf_height; local_y++) { - for (int local_x = pd->boundary.x1; local_x < pd->boundary.x2; local_x++) + for (int local_x = pd->boundary.x1; local_x < dst_buf_width; local_x++) { uint32_t *dst = dst_buf + ((int)local_x + ((int)local_y * pix_stride)); int rx, ry; |