Fix "Make sure we don't draw outside the bitmap on Splash::fillGlyph2" when painting with no aa

Fixes bug 15009

1 files changed, 8 insertions, 4 deletions

diff --git a/splash/Splash.cc b/splash/Splash.cc
index bf6d5061..970cf95a 100644
--- a/splash/Splash.cc
+++ b/splash/Splash.cc
@@ -1766,12 +1766,14 @@ void Splash::fillGlyph2(int x0, int y0, SplashGlyphBitmap *glyph, GBool noClip)
         p += glyph->w;
       }
     } else {
+      const int widthEight = (int)ceil(glyph->w / 8.0);
+
       pipeInit(&pipe, xStart, yStart,
                state->fillPattern, NULL, state->fillAlpha, gFalse, gFalse);
       for (yy = 0, y1 = yStart; yy < yyLimit; ++yy, ++y1) {
         pipeSetXY(&pipe, xStart, y1);
         for (xx = 0, x1 = xStart; xx < xxLimit; xx += 8) {
-          alpha0 = p[xx];
+          alpha0 = p[xx / 8];
           for (xx1 = 0; xx1 < 8 && xx + xx1 < xxLimit; ++xx1, ++x1) {
             if (alpha0 & 0x80) {
               pipeRun(&pipe);
@@ -1783,7 +1785,7 @@ void Splash::fillGlyph2(int x0, int y0, SplashGlyphBitmap *glyph, GBool noClip)
             alpha0 <<= 1;
           }
         }
-        p += glyph->w;
+        p += widthEight;
       }
     }
   } else {
@@ -1810,12 +1812,14 @@ void Splash::fillGlyph2(int x0, int y0, SplashGlyphBitmap *glyph, GBool noClip)
         p += glyph->w;
       }
     } else {
+      const int widthEight = (int)ceil(glyph->w / 8.0);
+
       pipeInit(&pipe, xStart, yStart,
                state->fillPattern, NULL, state->fillAlpha, gFalse, gFalse);
       for (yy = 0, y1 = yStart; yy < yyLimit; ++yy, ++y1) {
         pipeSetXY(&pipe, xStart, y1);
         for (xx = 0, x1 = xStart; xx < xxLimit; xx += 8) {
-          alpha0 = p[xx];
+          alpha0 = p[xx / 8];
           for (xx1 = 0; xx1 < 8 && xx + xx1 < xxLimit; ++xx1, ++x1) {
             if (state->clip->test(x1, y1)) {
               if (alpha0 & 0x80) {
@@ -1831,7 +1835,7 @@ void Splash::fillGlyph2(int x0, int y0, SplashGlyphBitmap *glyph, GBool noClip)
             alpha0 <<= 1;
           }
         }
-        p += glyph->w;
+        p += widthEight;
       }
     }
   }