diff options
| author | Robin Watts <robin@peeves.(none)> | 2012-06-11 11:49:31 -0700 |
|---|---|---|
| committer | Robin Watts <robin.watts@artifex.com> | 2012-06-11 19:55:54 +0100 |
| commit | 4fddb35e247a2d81b9b78ca3543b97da9e9fce45 (patch) | |
| tree | fe87bc8ab4351a8cb5a9892c83ab63837bb109b5 /draw/draw_edge.c | |
| parent | 120dabdf30be66b5d17f4c59862907bb5d176e27 (diff) | |
| download | mupdf-4fddb35e247a2d81b9b78ca3543b97da9e9fce45.tar.xz | |
Fix Bug 693102: Overflows in large pixmap indexing.
When we allocate a pixmap > 2G, but < 4G, the index into that
pixmap, when calculated as an int can be negative. Fix this with
various casts to unsigned int.
If we ever move to support >4G images we'll need to rejig the
casting to cast each part of the element to ptrdiff_t first.
Diffstat (limited to 'draw/draw_edge.c')
| -rw-r--r-- | draw/draw_edge.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/draw/draw_edge.c b/draw/draw_edge.c index 53b67b73..eac7cfba 100644 --- a/draw/draw_edge.c +++ b/draw/draw_edge.c @@ -624,7 +624,7 @@ static inline void blit_aa(fz_pixmap *dst, int x, int y, unsigned char *mp, int w, unsigned char *color) { unsigned char *dp; - dp = dst->samples + ( (y - dst->y) * dst->w + (x - dst->x) ) * dst->n; + dp = dst->samples + (unsigned int)(( (y - dst->y) * dst->w + (x - dst->x) ) * dst->n); if (color) fz_paint_span_with_color(dp, mp, dst->n, w, color); else @@ -725,7 +725,7 @@ static inline void blit_sharp(int x0, int x1, int y, x1 = CLAMP(x1, dst->x, dst->x + dst->w); if (x0 < x1) { - dp = dst->samples + ( (y - dst->y) * dst->w + (x0 - dst->x) ) * dst->n; + dp = dst->samples + (unsigned int)(( (y - dst->y) * dst->w + (x0 - dst->x) ) * dst->n); if (color) fz_paint_solid_color(dp, dst->n, x1 - x0, color); else |