Off-by-one-line error in QVGPaintEngine::drawImage

QVGPaintEngine::drawImage(const QPointF &pos, const QImage &image) uses
vgWritePixels if possible, and when the QImage is loaded from some file
types, its lines are inverted, stored from bottom to top in memory.

For inverted images, the image data pointer passed to vgWritePixels
should be pointing at the start of the last line. However drawImage was
actually passing a pointer to after the last line. This has undefined
results, but in practice you either get the image contents drawn one
line too high with the top line missing and and extra garbage bottom
line, or you can also get a crash if beyond the last line is not
readable memory.

Fixed by correcting the pointer passed to vgWritePixels to point to
the start of the last line for inverted images.

Task-number: ou1cimx1#996894
Change-Id: I1cf5b976acc18adceec1e14633f8779441faa056
Reviewed-by: Jani Hautakangas <jani.hautakangas@nokia.com>
Reviewed-by: Pasi Pentikäinen <ext-pasi.a.pentikainen@nokia.com>
(cherry picked from commit 85fac4c2239a024dfeff0561c4f07c2737eb961a)

1 files changed, 1 insertions, 1 deletions

diff --git a/src/openvg/qpaintengine_vg.cpp b/src/openvg/qpaintengine_vg.cpp
index d8b45dee14..d0ad6b27cc 100644
--- a/src/openvg/qpaintengine_vg.cpp
+++ b/src/openvg/qpaintengine_vg.cpp
@@ -3441,7 +3441,7 @@ void QVGPaintEngine::drawImage(const QPointF &pos, const QImage &image)
     if (canVgWritePixels(image)) {
         // Optimization for straight blits, no blending
         bool inverted = (d->imageTransform.m22() < 0);
-        const uchar *bits = inverted ? image.constBits() + image.byteCount() : image.constBits();
+        const uchar *bits = inverted ? image.constBits() + image.byteCount() - image.bytesPerLine() : image.constBits();
         int bpl = inverted ? -image.bytesPerLine() : image.bytesPerLine();
 
         QPointF mapped = d->imageTransform.map(pos);