|
 |
db2a8b |
From 8122f6d6d409b53151a20c5578fc525ee97315e8 Mon Sep 17 00:00:00 2001
|
|
|
db2a8b |
From: Marek Kasik <mkasik@redhat.com>
|
|
|
db2a8b |
Date: Thu, 21 Mar 2019 13:47:51 +0100
|
|
|
db2a8b |
Subject: [PATCH 2/2] cairo: Constrain number of cycles in rescale filter
|
|
|
db2a8b |
|
|
|
db2a8b |
Pass address of the first byte after end of the source buffer
|
|
|
db2a8b |
to downsample_row_box_filter() so that we can check
|
|
|
db2a8b |
that we don't run out of it.
|
|
|
db2a8b |
|
|
|
db2a8b |
Fixes issue #736
|
|
|
db2a8b |
---
|
|
|
db2a8b |
poppler/CairoRescaleBox.cc | 18 +++++++++---------
|
|
|
db2a8b |
1 file changed, 9 insertions(+), 9 deletions(-)
|
|
|
db2a8b |
|
|
|
db2a8b |
diff --git a/poppler/CairoRescaleBox.cc b/poppler/CairoRescaleBox.cc
|
|
|
db2a8b |
index d7615010..7fd07041 100644
|
|
|
db2a8b |
--- a/poppler/CairoRescaleBox.cc
|
|
|
db2a8b |
+++ b/poppler/CairoRescaleBox.cc
|
|
|
db2a8b |
@@ -62,7 +62,7 @@
|
|
|
db2a8b |
|
|
|
db2a8b |
static void downsample_row_box_filter (
|
|
|
db2a8b |
int start, int width,
|
|
|
db2a8b |
- uint32_t *src, uint32_t *dest,
|
|
|
db2a8b |
+ uint32_t *src, uint32_t *src_limit, uint32_t *dest,
|
|
|
db2a8b |
int coverage[], int pixel_coverage)
|
|
|
db2a8b |
{
|
|
|
db2a8b |
/* we need an array of the pixel contribution of each destination pixel on the boundaries.
|
|
|
db2a8b |
@@ -90,13 +90,13 @@ static void downsample_row_box_filter (
|
|
|
db2a8b |
/* skip to start */
|
|
|
db2a8b |
/* XXX: it might be possible to do this directly instead of iteratively, however
|
|
|
db2a8b |
* the iterative solution is simple */
|
|
|
db2a8b |
- while (x < start)
|
|
|
db2a8b |
+ while (x < start && src < src_limit)
|
|
|
db2a8b |
{
|
|
|
db2a8b |
int box = 1 << FIXED_SHIFT;
|
|
|
db2a8b |
int start_coverage = coverage[x];
|
|
|
db2a8b |
box -= start_coverage;
|
|
|
db2a8b |
src++;
|
|
|
db2a8b |
- while (box >= pixel_coverage)
|
|
|
db2a8b |
+ while (box >= pixel_coverage && src < src_limit)
|
|
|
db2a8b |
{
|
|
|
db2a8b |
src++;
|
|
|
db2a8b |
box -= pixel_coverage;
|
|
|
db2a8b |
@@ -104,7 +104,7 @@ static void downsample_row_box_filter (
|
|
|
db2a8b |
x++;
|
|
|
db2a8b |
}
|
|
|
db2a8b |
|
|
|
db2a8b |
- while (x < start + width)
|
|
|
db2a8b |
+ while (x < start + width && src < src_limit)
|
|
|
db2a8b |
{
|
|
|
db2a8b |
uint32_t a = 0;
|
|
|
db2a8b |
uint32_t r = 0;
|
|
|
db2a8b |
@@ -121,7 +121,7 @@ static void downsample_row_box_filter (
|
|
|
db2a8b |
x++;
|
|
|
db2a8b |
box -= start_coverage;
|
|
|
db2a8b |
|
|
|
db2a8b |
- while (box >= pixel_coverage)
|
|
|
db2a8b |
+ while (box >= pixel_coverage && src < src_limit)
|
|
|
db2a8b |
{
|
|
|
db2a8b |
a += ((*src >> 24) & 0xff) * pixel_coverage;
|
|
|
db2a8b |
r += ((*src >> 16) & 0xff) * pixel_coverage;
|
|
|
db2a8b |
@@ -135,7 +135,7 @@ static void downsample_row_box_filter (
|
|
|
db2a8b |
/* multiply by whatever is leftover
|
|
|
db2a8b |
* this ensures that we don't bias down.
|
|
|
db2a8b |
* i.e. start_coverage + n*pixel_coverage + box == 1 << 24 */
|
|
|
db2a8b |
- if (box > 0)
|
|
|
db2a8b |
+ if (box > 0 && src < src_limit)
|
|
|
db2a8b |
{
|
|
|
db2a8b |
a += ((*src >> 24) & 0xff) * box;
|
|
|
db2a8b |
r += ((*src >> 16) & 0xff) * box;
|
|
|
db2a8b |
@@ -337,7 +337,7 @@ bool CairoRescaleBox::downScaleImage(unsigned orig_width, unsigned orig_height,
|
|
|
db2a8b |
int start_coverage_y = y_coverage[dest_y];
|
|
|
db2a8b |
|
|
|
db2a8b |
getRow(src_y, scanline);
|
|
|
db2a8b |
- downsample_row_box_filter (start_column, width, scanline, temp_buf + width * columns, x_coverage, pixel_coverage_x);
|
|
|
db2a8b |
+ downsample_row_box_filter (start_column, width, scanline, scanline + orig_width, temp_buf + width * columns, x_coverage, pixel_coverage_x);
|
|
|
db2a8b |
columns++;
|
|
|
db2a8b |
src_y++;
|
|
|
db2a8b |
box -= start_coverage_y;
|
|
|
db2a8b |
@@ -345,7 +345,7 @@ bool CairoRescaleBox::downScaleImage(unsigned orig_width, unsigned orig_height,
|
|
|
db2a8b |
while (box >= pixel_coverage_y)
|
|
|
db2a8b |
{
|
|
|
db2a8b |
getRow(src_y, scanline);
|
|
|
db2a8b |
- downsample_row_box_filter (start_column, width, scanline, temp_buf + width * columns, x_coverage, pixel_coverage_x);
|
|
|
db2a8b |
+ downsample_row_box_filter (start_column, width, scanline, scanline + orig_width, temp_buf + width * columns, x_coverage, pixel_coverage_x);
|
|
|
db2a8b |
columns++;
|
|
|
db2a8b |
src_y++;
|
|
|
db2a8b |
box -= pixel_coverage_y;
|
|
|
db2a8b |
@@ -355,7 +355,7 @@ bool CairoRescaleBox::downScaleImage(unsigned orig_width, unsigned orig_height,
|
|
|
db2a8b |
if (box > 0)
|
|
|
db2a8b |
{
|
|
|
db2a8b |
getRow(src_y, scanline);
|
|
|
db2a8b |
- downsample_row_box_filter (start_column, width, scanline, temp_buf + width * columns, x_coverage, pixel_coverage_x);
|
|
|
db2a8b |
+ downsample_row_box_filter (start_column, width, scanline, scanline + orig_width, temp_buf + width * columns, x_coverage, pixel_coverage_x);
|
|
|
db2a8b |
columns++;
|
|
|
db2a8b |
}
|
|
|
db2a8b |
|
|
|
db2a8b |
--
|
|
|
db2a8b |
2.20.1
|
|
|
db2a8b |
|