summaryrefslogtreecommitdiff
path: root/splash
diff options
context:
space:
mode:
authorAlbert Astals Cid <aacid@kde.org>2013-08-18 16:19:27 +0200
committerAlbert Astals Cid <aacid@kde.org>2013-08-18 16:19:52 +0200
commit678c767584fa80620cc58a1d8a913cb3473209d4 (patch)
tree846e649f626d93c670e86f4cb0631bc40a1f632e /splash
parentfbea2241cccdde0106d2c34592b6ddda28a8d848 (diff)
Fix crash in 1026.asan.0.42.pdf
We were not checking that bitmapOff was in bounds
Diffstat (limited to 'splash')
-rw-r--r--splash/Splash.cc3
1 files changed, 2 insertions, 1 deletions
diff --git a/splash/Splash.cc b/splash/Splash.cc
index ccfe1ed6..d5aec8f9 100644
--- a/splash/Splash.cc
+++ b/splash/Splash.cc
@@ -5420,6 +5420,7 @@ GBool Splash::gouraudTriangleShadedFill(SplashGouraudColor *shading)
SplashClip* clip = getClip();
SplashBitmap *blitTarget = bitmap;
SplashColorPtr bitmapData = bitmap->getDataPtr();
+ int bitmapOffLimit = bitmap->getHeight() * bitmap->getRowSize();
SplashColorPtr bitmapAlpha = bitmap->getAlphaPtr();
SplashColorPtr cur = NULL;
SplashCoord* userToCanvasMatrix = getMatrix();
@@ -5652,7 +5653,7 @@ GBool Splash::gouraudTriangleShadedFill(SplashGouraudColor *shading)
colorinterp = scanColorMap[0] * scanLimitL + scanColorMap[1];
bitmapOff = scanLineOff + scanLimitL * colorComps;
- for (int X = scanLimitL; X <= scanLimitR; ++X, colorinterp += scanColorMap[0], bitmapOff += colorComps) {
+ for (int X = scanLimitL; X <= scanLimitR && bitmapOff + colorComps <= bitmapOffLimit; ++X, colorinterp += scanColorMap[0], bitmapOff += colorComps) {
// FIXME : standard rectangular clipping can be done for a
// complete scanline which is faster
// --> see SplashClip and its methods